Executive brief
The forms library is a Node.js package used to generate HTML forms programmatically. A cross-site scripting (XSS) vulnerability in the form rendering code allows attackers to inject malicious JavaScript into generated forms by crafting specially crafted input that is not properly escaped, potentially compromising end-user security and data.
Technical details
The vulnerability is a reflected/stored cross-site scripting (CWE-80) in the forms library's tag rendering functionality. The library failed to properly escape HTML content when generating form output, allowing attacker-controlled input to be rendered as unescaped HTML in the resulting forms. The vulnerability affects all versions prior to 1.3.0, with no authentication required—any application using forms to render user-supplied input is vulnerable. An attacker can inject arbitrary JavaScript that executes in users' browsers when they interact with affected forms. The fix was committed to ensure all content in the `tag` component is properly escaped before rendering.
Affected products
- caolan forms <1.3.0
Timeline
- 2018-11-09: disclosed
- 2016-11-15: patched: Fix commit merged; version 1.3.0 or later contains the fix