Executive brief
seeftl is an npm package used for template file processing. The package does not sanitize filenames when rendering, allowing an attacker to inject malicious JavaScript code through specially crafted file names. If a user processes files from an untrusted source, their browser could execute arbitrary code, leading to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw in the seeftl package caused by insufficient input validation of filenames. The package fails to sanitize or encode filenames before rendering them in a web context, allowing an attacker to embed JavaScript payloads in file names. When a user's browser processes these filenames (e.g., displayed in a listing or template output), the embedded script executes with the privileges of the user's session. The attack requires no authentication but does require the victim to process or view files with malicious names. No fix has been released; users are advised to migrate to alternative packages.
Affected products
- seeftl seeftl 0.1.1 and all previous versions
Timeline
- 2020-04-01: disclosed
- other: CVE-2019-15603 assigned