Description (CNA)
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://www.npmjs.com/advisories/822
- https://github.com/dollarshaveclub/shave/commit/da7371b0531ba14eae48ef1bb1456a3de4cfa954#diff-074799b511e4b61923dfd3f2a3bf9b54R67
- https://github.com/dollarshaveclub/shave/compare/852b537...da7371b
ADP enrichment
No English description supplied.