Executive brief
ghtml is a JavaScript templating library used to generate HTML content in web applications. The library fails to properly encode attribute values and does not sanitize href attributes, allowing an attacker to inject malicious JavaScript code. An authenticated user with the ability to control template input could execute arbitrary JavaScript in the browsers of other users viewing the affected page, potentially leading to account compromise or data theft.
Technical details
This is a Cross-Site Scripting (XSS) vulnerability (CWE-79, CWE-80) in the ghtml templating library caused by incomplete encoding of HTML attribute values and lack of href attribute validation. The vulnerability requires network access, low-level privileges (authenticated user), and user interaction (the victim must view a page containing the malicious payload). An attacker can introduce user-controlled JavaScript code to trigger XSS, potentially accessing sensitive data or modifying page content. The vulnerability affects all versions prior to 2.0.0, which added backtick escaping and improved documentation on the need for supplementary input sanitization. Patches are available in version 2.0.0 and later.
Affected products
- gurgunday ghtml <2.0.0
Timeline
- 2024-06-10: disclosed
- 2024-06-10: patched: Fixed in version 2.0.0