Executive brief
vant is a popular Vue component library used to build mobile user interfaces. The Picker component, which allows users to select values from a list, fails to sanitize text values passed to it, allowing attackers to inject and execute arbitrary JavaScript code in a victim's browser through crafted input.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw in the vant Picker component. The text values of the Picker's column property are rendered directly into the DOM without sanitization, allowing attackers to inject malicious HTML and JavaScript. An attacker can exploit this by providing HTML or script tags as column text values, which will be executed in the victim's browser when the component renders. The vulnerability requires no authentication and is network-accessible if the application accepts user-controlled input for Picker values. The fix involves sanitizing text values before rendering, or adding an "allow-html" property to explicitly control HTML rendering. The issue was addressed in version 2.1.8 released in 2019.
Affected products
- Youzan vant prior to 2.1.8
Timeline
- 2019-08-28: disclosed
- 2019-08-28: patched: version 2.1.8 released