Executive brief
store2 is a JavaScript library for client-side data storage. A cross-site scripting (XSS) vulnerability in its store.deep.js extension allows attackers to execute arbitrary code in the browser if user input is passed to the store.get() function without sanitization. An attacker could exploit this to steal session cookies, perform unauthorized actions on behalf of users, or redirect users to malicious sites.
Technical details
The vulnerability is a reflected XSS flaw caused by unsafe use of eval() in the store.deep.js component at line 31. The eval() function is called to resolve nested object property paths based on user-supplied key parameters. An attacker can inject arbitrary JavaScript code into the key argument passed to store.get()—for example, store.get('someKey.key;alert(1337)')—and the eval will execute it in the victim's browser context. No authentication or user interaction beyond a single API call is required if the application passes user-controlled input directly to store.get(). The vulnerability is fixed in version 2.14.4 by replacing eval() with explicit string splitting and property traversal.
Affected products
- nbubna store2 2.14.2 and earlier
Timeline
- 2024-12-26: disclosed: Issue opened on GitHub
- 2025-01-23: advisory: NVD published
- 2025-01-24: other: GHSA published