Executive brief
The @spscommerce/ds-react library is a React component library used by web applications to build user interfaces. A cross-site scripting (XSS) vulnerability in the Select component allows attackers to inject malicious scripts if the component's options are populated from untrusted user input. This could lead to account takeover, session hijacking, or theft of sensitive customer data depending on the context of affected applications.</exec_brief> <parameter name="technical_details">The vulnerability is a cross-site scripting (CWE-79) flaw in the SpsSelect component when the options prop is populated from user-controlled input. The vulnerable code in SpsOptionList.tsx does not properly sanitize or escape option values before rendering them in the DOM, allowing an attacker to inject arbitrary JavaScript. The flaw affects versions 4.12.2 through 7.17.3 of @spscommerce/ds-react. An attacker must have the ability to control the options data passed to the Select component; if these options are persisted (e.g., stored in a database), the XSS becomes stored and affects all users viewing the affected interface. The vulnerability has been patched in version 7.17.4 and higher; applications must upgrade to remediate or implement their own option sanitization.
Affected products
- SPS Commerce ds-react 4.12.2 through 7.17.3
Timeline
- 2023-12-15: disclosed
- 2023-12-15: patched: Fixed in version 7.17.4