Executive brief
Verdaccio is a lightweight private Node.js package registry. A reflected cross-site scripting (XSS) vulnerability allows attackers to inject malicious JavaScript into package metadata displayed in the web UI, potentially stealing user credentials or session tokens from administrators viewing affected packages.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in Verdaccio's web UI that fails to properly sanitize or escape user-supplied content in package metadata. Malicious packages can contain JavaScript payloads that execute in the browsers of users viewing the package information. The attack requires a user to view a crafted package in the UI (user interaction required). An attacker can steal session cookies, credentials, or perform actions on behalf of the victim. The issue affects all versions prior to 3.12.0; users on v3 should upgrade to 3.12.0 or later, or migrate to v4.0.0+.
Affected products
- Verdaccio Verdaccio <3.12.0
Timeline
- 2019-05-29: disclosed: Published as GHSA-78j5-gcmf-vqc8 and CVE-2019-14772
- 2019-05-27: patched: Fix released in version 3.12.0 and 4.0.0+