Executive brief
selectize-plugin-a11y is a JavaScript library that adds accessibility features to the Selectize form control. Versions prior to 1.1.0 fail to sanitize user input before rendering it as HTML in the accessibility live region feature, allowing attackers to inject and execute arbitrary JavaScript in users' browsers. This can lead to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a reflected/stored cross-site scripting (XSS) flaw in the accessibility.liveRegion.speak function. The root cause is that the msg parameter is inserted directly into the DOM as HTML without sanitization (CWE-79). An attacker can exploit this by supplying crafted user input containing JavaScript code, which executes in the victim's browser when the accessibility feature processes the message. The attack requires user interaction (UI:R) and network reachability, but no authentication. The fix (version 1.1.0+) changes the function to insert msg as text content rather than raw HTML, preventing script execution.
Affected products
- SalmenBejaoui selectize-plugin-a11y prior to 1.1.0
Timeline
- 2019-08-27: disclosed: GHSA-8cpw-73f2-w58m published
- 2019-07-15: patched: Fix merged in PR #9, version 1.1.0 released
- 2025-01-07: other: Repository archived and made read-only