Executive brief
epubjs is a popular JavaScript library for rendering EPUB e-books in web browsers. A cross-site scripting (XSS) vulnerability in its iframe handling allows an attacker to inject malicious scripts that could execute in the context of web applications using this library, potentially compromising user sessions or stealing sensitive data.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in managers/views/iframe.js of epubjs before version 0.3.89. The vulnerable component fails to properly sanitize or sandbox iframe content, allowing attackers to inject arbitrary JavaScript. The attack requires user interaction (opening a malicious EPUB file) but is network-accessible and requires no authentication. Successful exploitation allows execution of arbitrary JavaScript in the application's security context. The fix, applied in version 0.3.89, implements iframe sandboxing to restrict the execution environment.
Affected products
- FuturePress epubjs before 0.3.89
Timeline
- 2022-01-17: disclosed: NVD publication date
- 2022-01-21: patched: Version 0.3.89 released with iframe sandboxing fix