Headline
CVE-2021-32860: GHSL-2021-1044: Security contact needed · Issue #249 · marcelodolza/iziModal
iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field title when creating a iziModal instance is able to supply arbitrary html or javascript code that will be rendered in the context of a user, potentially leading to XSS. Version 1.6.1 contains a patch for this issue
Comments
Hello,
The GitHub Security Lab team has found a potential vulnerability in your project. Please create a Security Advisory and invite me in to further disclose and discuss the vulnerability details and potential fix. Alternatively, please add a Security Policy containing a security email address to send the details to.
If you prefer to contact us by email, please reach out to [email protected] with reference to GHSL-2021-1044.
Thank you,
@agustingianni
GitHub Security Lab
The GitHub Security Lab reported a potential security vulnerability (GHSL-2021-1044) in your project on 2021-11-24. It has been 183 days since our initial report and as per our coordinated disclosure policy, we intend to publish a public advisory detailing this issue. If you do wish to further coordinate a response to this issue with the GitHub Security Lab, please contact us at [email protected] within the next 7 days in reference to GHSL-2021-1044 and we would love to help you resolve these issues. If not, feel free to close this issue after which we will proceed with advisory publication.
Hello @agustingianni, I saw your message recently and I just replied to your email.
An update has been released.
Thanks again.
2 participants
Related news
iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field `title` when creating a `iziModal` instance is able to supply arbitrary `html` or `javascript` code that will be rendered in the context of a user, potentially leading to `XSS`. Version 1.6.1 contains a patch for this issue