Executive brief
Layui is a JavaScript UI framework used to build web interfaces and data tables. A cross-site scripting (XSS) vulnerability in versions up to 2.74 allows attackers to inject malicious JavaScript through the table template data-content parameter, potentially stealing user sessions, credentials, or sensitive data displayed in the application.
Technical details
Layui versions up to 2.74 contain a stored XSS vulnerability (CWE-79) in the table rendering component. The vulnerability exists in the data-content parameter handling when custom templates are used; user-supplied input is concatenated directly into HTML attributes without proper sanitization or escaping. An attacker can craft malicious table column templates containing JavaScript payloads that execute in the context of other users' browsers. The attack requires knowledge of the application's table configuration but does not require authentication. The vulnerability was fixed in version 2.7.5.
Affected products
- Layui layui up to 2.74
Timeline
- 2023-12-30: disclosed
- 2023-12-30: patched: Fixed in version 2.7.5