Executive brief
Slim Select is a JavaScript dropdown/select library used to enhance form inputs on websites. A cross-site scripting vulnerability in versions 2.0–2.9.0 allows attackers to inject malicious JavaScript code through unsanitized user input when dynamically generating select options. This can lead to credential theft, session hijacking, or malware distribution to website visitors.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the createOption() function within select.ts. The text variable from user-provided Options objects is directly assigned to innerHTML without sanitization, allowing arbitrary HTML and JavaScript injection. The attack requires user interaction (clicking the select field) and depends on the host application accepting and rendering unsanitized user input. An attacker can achieve arbitrary JavaScript execution in the victim's browser with the privileges of the affected website. The vulnerability is fixed in version 2.9.2; all versions from 2.0.0 through 2.9.0 are affected.
Affected products
- Slim Select Slim Select 2.0.0 through 2.9.0
Timeline
- 2024-10-02: disclosed
- 2024-10-02: patched: Fixed in version 2.9.2