Headline
CVE-2017-18635: Release v0.6.2 · novnc/noVNC
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
- Releases
- v0.6.2
_This is a vulnerability fix release._
Fixes a XSS issue in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
This affects users of vnc_auto.html and vnc.html, as well as any users of include/ui.js.
Thanks to David Wyde of Cisco for reporting the issue.