Executive brief
Glossarizer is a JavaScript library that converts text and glossary entries into interactive HTML. The library improperly handles HTML encoding, allowing attackers to inject malicious JavaScript code through glossary terms. An attacker can craft a glossary entry containing XSS payloads that execute in users' browsers when the glossary is rendered, potentially stealing session data or performing unauthorized actions.
Technical details
Glossarizer through version 1.5.2 contains a stored cross-site scripting (XSS) vulnerability in its HTML text conversion functionality. The root cause is a double-encoding issue: while the application escapes special HTML characters (converting them to entities like < and >), the underlying library subsequently converts these encoded entities back into legitimate HTML tags, bypassing the initial sanitization. An attacker can inject JavaScript payloads as part of glossary entries, and when these entries are processed and displayed, the malicious code executes in the context of affected web pages. The vulnerability requires user interaction (viewing the glossary) but has broad scope (C:L/I:L) affecting confidentiality and integrity. Patch status and remediation details are not specified in the advisory.
Affected products
- PebbleRoad Glossarizer through 1.5.2
Timeline
- 2024-10-31: disclosed
- 2024-11-01: advisory