Executive brief
eslint-detailed-reporter is an npm package that generates detailed HTML reports of ESLint code linting results. The package fails to properly sanitize issue messages before inserting them into the HTML output, allowing malicious code in linting rule messages to execute in a user's browser when viewing the report.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in the `renderIssue` function within `lib/template-generator.js`. The vulnerable code fails to properly escape the message argument when inserting it into generated HTML, allowing unsanitized content from ESLint rule messages to be rendered as executable code. An attacker could craft a malicious ESLint rule or plugin that outputs XSS payloads in rule messages, which would then execute in the browser of anyone viewing the generated HTML report. The attack requires user interaction (viewing the report) and authentication/local access to run ESLint. A fix was merged in commit 505c190 which uses `_.escape()` for proper HTML entity escaping instead of the previous `formatSourceCode` function, and is available in versions after 0.9.0.
Affected products
- mportuga eslint-detailed-reporter up to 0.9.0
Timeline
- 2023-04-20: disclosed: Published to GitHub Advisory Database
- 2022-06-02: patched: Fix merged in commit 505c190efd4905990db6207863bdcbd9b1d7e1bd