Executive brief
htmr is a JavaScript library used to convert HTML strings into React components. The library uses an unsafe method (innerHTML) to unescape HTML entities, allowing attackers to inject malicious JavaScript code through HTML-encoded payloads. This could enable an attacker to steal session tokens, redirect users, or perform actions on their behalf in any application using the vulnerable library.
Technical details
This is a DOM-based Cross-Site Scripting (CWE-79) vulnerability in htmr versions prior to 0.8.7. The root cause is the use of innerHTML to unescape HTML entities, which does not sanitize the output and allows execution of arbitrary JavaScript embedded in HTML-encoded payloads. The vulnerability can be triggered when an attacker provides specially crafted HTML-encoded XSS payloads to the library, with no authentication or special preconditions required beyond sending malicious input. An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to credential theft, session hijacking, or malware distribution. The fix is available in version 0.8.7 and later.
Affected products
- htmr htmr prior to 0.8.7
Timeline
- 2020-09-03: disclosed
- 2020-08-31: patched: Fix available in version 0.8.7