Executive brief
shave is a JavaScript library that truncates text in web pages. The library fails to properly encode HTML when rewriting elements, allowing attacker-controlled content to be decoded and executed as JavaScript in users' browsers. An attacker could inject malicious scripts that steal session tokens, redirect users, or modify page content.
Technical details
shave versions prior to 2.5.3 contain a Cross-Site Scripting (CWE-79) vulnerability caused by improper HTML encoding when the library processes and rewrites DOM elements. When pre-encoded HTML is passed to shave, the library decodes it without re-encoding, allowing embedded scripts to execute. The vulnerability is triggered client-side when a web page uses shave on user-controlled or attacker-influenced content. Fix is available in version 2.5.3 and later, which uses createTextNode() to safely handle text insertion.
Affected products
- Dollar Shave Club shave prior to 2.5.3
Timeline
- 2019-05-29: disclosed
- 2019-05-29: patched: Version 2.5.3 released with fix