What is GHSA-gvg7-pp82-cff3?

GHSA-gvg7-pp82-cff3 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting in c3

Which CVE IDs does GHSA-gvg7-pp82-cff3 cover?

GHSA-gvg7-pp82-cff3 covers the following CVE IDs: CVE-2016-1000240. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gvg7-pp82-cff3?

GHSA-gvg7-pp82-cff3 affects 1 product, including: npm/c3:\u003c= 0.4.10.

GHSA-gvg7-pp82-cff3Medium

Cross-Site Scripting in c3

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

April 5, 2023

🔗 CVE IDs covered (1)

CVE-2016-1000240 →

📋 Description

Affected versions of c3 are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips.

Recommendation

Update to 0.4.11 or later.

🎯 Affected products1

npm/c3:<= 0.4.10

🔗 References (6)

https://github.com/c3js/c3/issues/1536
https://www.npmjs.com/advisories/138
https://nvd.nist.gov/vuln/detail/CVE-2016-1000240
https://github.com/c3js/c3/pull/1675
https://github.com/c3js/c3/commit/de3864650300488a63d0541620e9828b00e94b42
https://github.com/advisories/GHSA-gvg7-pp82-cff3