Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cross-Site Scripting (XSS) in ibm-gantt-chart

See original GitHub issue

Description

ibm-gantt-chart is vulnerable to Cross-Site Scripting (XSS).

Steps To Reproduce

Open https://www.npmjs.com/package/ibm-gantt-chart
Copy the code from the usage example and make a test.html https://www.npmjs.com/package/ibm-gantt-chart#usage
And use <link href="https://unpkg.com/ibm-gantt-chart@0.5.9/dist/ibm-gantt-chart.css" rel="stylesheet" /> and <script src="https://unpkg.com/ibm-gantt-chart@0.5.9/dist/ibm-gantt-chart.js"></script>
Insert the xss payload in name field in data Ex: name: 'Bethanie"<img src=x onerror=alert(1)>',
Open the test.html file in any browser, XSS payload will get executed.

Issue Analytics

State:
Created 3 years ago
Reactions:1
Comments:8 (4 by maintainers)

Top GitHub Comments

1reaction

JamieSlomecommented, Sep 15, 2021

@delhoume - this technology is no longer supported.

I will manually open the PR for you!

1reaction

delhoumecommented, Sep 15, 2021

@huntr-helper - LGTM in 418sec#1

Top Results From Across the Web

WBS Gantt-Chart add-on for JIRA data-export feature cross-site ...

WBS Gantt-Chart add-on for JIRA is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit ...

Security Bulletin: A cross-site scripting (XSS) vulnerability ...

A cross-site scripting (XSS) vulnerability may impact IBM Cúram Social Program Management. This vulnerability allows attackers to inject ...

Protect from cross-site scripting attacks

In a cross-site scripting (XSS) attack, an attacker injects HTML markup or JavaScript into the affected web application's front-end client.

Multiple cross-site scripting vulnerabilities in JQuery affect ...

DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the jQuery.

NVD - Results - National Institute of Standards and Technology

Cross -site scripting (XSS) vulnerability in the data-export feature in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote ...