GHSA-c7pp-g2v2-2766High

DOM-based XSS in gmail-js

Published
September 1, 2020
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-1000228 →

📋 Description

Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor.

Recommendation

Update to version 0.6.5 or later.

🎯 Affected products1

  • npm/gmail-js:<= 0.6.4

🔗 References (5)