Executive brief
lazysizes is a popular lazy-loading library used to improve web page performance by deferring image and media loading. A cross-site scripting (XSS) vulnerability in its video-embed plugin allows attackers to inject malicious JavaScript through unsanitized HTML attributes, potentially compromising user accounts or stealing sensitive data when viewing affected web pages.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in lazysizes versions through 5.2.0, specifically in the video-embed plugin. The plugin fails to sanitize the data-vimeo, data-vimeoparams, data-youtube, and data-ytparams HTML attributes, allowing attackers to inject arbitrary JavaScript. Exploitation requires the attacker to control the HTML content of a web page using lazysizes (e.g., via a compromised CMS or user-contributed content) and for a victim to view that page. An attacker can execute JavaScript in the victim's browser context, potentially stealing cookies, session tokens, or performing actions on behalf of the user. The vulnerability was patched in version 5.2.1.
Affected products
- Alexander Farkas lazysizes through 5.2.0
Timeline
- 2020-04-22: disclosed
- 2021-05-25: patched: Fixed in version 5.2.1