Executive brief
The npm "public" package is vulnerable to stored cross-site scripting (XSS), allowing attackers to inject malicious JavaScript code that persists in the application and executes in users' browsers. This vulnerability affects all versions of the package, and no fix is currently available, making the package unsuitable for use until patched.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw affecting all versions of the npm "public" library. The vulnerability allows attackers to inject malicious scripts that are stored and executed client-side in users' browsers. No preconditions such as authentication are mentioned, suggesting the vulnerability may be exploitable through untrusted input handling. At the time of publication, no patch was available; the advisory explicitly recommends against using the module until a fix is released. The vulnerability was introduced at version 0 and potentially addressed in version 0.1.4, though version 0.1.5 remains affected.
Affected products
- npm public all versions prior to 0.1.4
Timeline
- 2019-05-31: disclosed
- other: No fix available as of publication date