Executive brief
lazysizes is a JavaScript library used to lazy-load images and videos on web pages to improve performance. The video-embed plugin fails to properly sanitize user-controlled HTML attributes (data-vimeo, data-vimeoparams, data-youtube, data-ytparams) when embedding videos, allowing attackers to inject and execute arbitrary JavaScript code in the browsers of users viewing affected pages. This could lead to account takeover, data theft, or malware distribution.
Technical details
The vulnerability is a classic Stored/Reflected Cross-Site Scripting (CWE-79) flaw in the video-embed plugin of lazysizes. The plugin constructs iframe HTML dynamically by concatenating user-controlled data attributes (data-vimeo, data-vimeoparams, data-youtube, data-ytparams) directly into elem.innerHTML without proper sanitization or encoding. The attack vector is network-based; an attacker with control over HTML markup (via DOM manipulation, template injection, or compromised content) can craft malicious payloads in these attributes that execute arbitrary JavaScript when the plugin processes the video embed. The vulnerability affects all versions prior to 5.2.1-rc1. A patch is available in version 5.2.1-rc1 and later.
Affected products
- aFarkas lazysizes < 5.2.1-rc1
Timeline
- 2020-03-09: disclosed
- 2020-05-31: patched: Fix available in 5.2.1-rc1
- 2020-09-03: advisory