Junglewise Threat Intelligence

CVE-2023-1001: xuliangzhan vxe-table XSS in vxe-textarea component

CVE-2023-1001 · Severity: low · CVSS 3.1 · Published 2024-05-24

Vendors: npm.

Executive brief

vxe-table is a popular Vue-based component library used for building complex data tables and forms in web applications. A security vulnerability in the textarea component could allow an attacker to inject malicious scripts that execute in a user's browser. This could lead to unauthorized actions being performed on behalf of the user or the defacement of the application interface.

Technical details

A Cross-site Scripting (XSS) vulnerability exists in the vxe-textarea component of the vxe-table library up to version 3.7.9. The vulnerability is located in the export function within 'packages/textarea/src/textarea.js'. Specifically, improper neutralization of the 'inputValue' argument allows an attacker to inject and execute arbitrary JavaScript in the context of the victim's browser. This is a stored or reflected XSS that requires low privileges and some user interaction. The issue has been addressed in version 3.7.10 by implementing proper input handling.

Affected products

  • xuliangzhan vxe-table <= 3.7.9

Timeline

  • 2024-05-24: advisory: GitHub Advisory published
  • 2024-05-24: disclosed: NVD publication date
  • 2024-05-24: patched: Version 3.7.10 released with fix

References

Related threats