Executive brief
DataTables.net is a popular JavaScript library used to enhance HTML tables with interactive features like sorting and filtering. This vulnerability allows attackers to inject malicious JavaScript code through improperly escaped HTML, which could steal user data or hijack user sessions when viewing affected pages.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in the HTML escape entities function within DataTables.net. The flaw occurs when an array is passed to the escaping function—the function fails to escape the contents of the array, leaving them vulnerable to XSS injection. The vulnerability is triggered via user interaction (requires a user to view a page containing malicious data), and the scope is changed, meaning the attack can affect resources beyond the vulnerable application. The vulnerability was fixed in version 1.11.3 and earlier versions (before 1.11.3) are affected.
Affected products
- DataTables DataTables.net before 1.11.3
Timeline
- 2021-09-27: disclosed: NVD published
- 2021-09-29: disclosed: GHSA advisory published
- 2021-09-28: patched: Fixed in version 1.11.3 with commit 59a8d3f