Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cross Site Scripting（XSS）vulnerability in code-server

See original GitHub issue

OS/Web Information

Web Browser: firefox
Local OS: Debian
Remote OS:Debian
Remote Architecture:
code-server --version: v3.12.0

Steps to Reproduce

1.Open your browser and insert payload /static/test%3Cmy_tag_efb4535077ba29aaca28167c491b4249/%3E%3Cimg%20src=x%3E%3Cscript%3Ealert(1)%3C/script%3E

2.example: http://127.0.0.1:8080/static/test%3Cmy_tag_efb4535077ba29aaca28167c491b4249/%3E%3Cimg%20src=x%3E%3Cscript%3Ealert(1)%3C/script%3E

Screenshot

Notes

This issue can be reproduced in VS Code: Yes

Issue Analytics

State:
Created 2 years ago
Reactions:3
Comments:7 (4 by maintainers)

Top GitHub Comments

2reactions

mauri-sfdccommented, Oct 29, 2021

@code-asher I can take a crack at the fix

2reactions

code-ashercommented, Oct 29, 2021

Very true! 😄

I believe we have switching to a templating system on our roadmap, maybe for now we can fix this issue until that switch happens.

Top Results From Across the Web

Cross-site Scripting (XSS) in code-server | CVE-2021-42648

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via a specially crafted URL which executes JavaScript code when ...

Cross Site Scripting（XSS）vulnerability in code-server #4355

Very true! :D I believe we have switching to a templating system on our roadmap, maybe for now we can fix this issue...

Cross site scripting in code-server - Vulners

Cross -site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL.

Cross Site Scripting (XSS) - OWASP Foundation

Overview. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.

CVE-2021-42648 : Cross-site scripting (XSS) vulnerability exists in ...

Cross -site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL.