Homepage
About Snyk

HTML Injection Affecting awesomplete package, versions *

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    Exploit Maturity Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-AWESOMPLETE-174474
  • published 23 Apr 2019
  • disclosed 22 Apr 2019
  • credit ArthurHoaro
Report a new vulnerability Found a mistake?

Introduced: 22 Apr 2019

CVE NOT AVAILABLE CWE-74 Open this link in a new tab

How to fix?

There is no fixed version for awesomplete.

Overview

awesomplete is a lightweight, customizable, autocomplete widget for web applications.

Affected versions of this package are vulnerable to HTML Injection due to not processing text containing html tags properly. This may allow attackers to inject arbitrary HTML into a vulnerable web page.

PoC 

<html>
  <head>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/awesomplete/1.1.4/awesomplete.css" />
<script src="https://cdnjs.cloudflare.com/ajax/libs/awesomplete/1.1.4/awesomplete.js" async></script>

  </head>
  
  <body>
   <input class="awesomplete" data-list="#mylist" data-minchars="1" />
<ul id="mylist">
    <li> Seach for the following: &lt;h1&gt;Heading Tag Example&lt;/h1&gt;</li>
</ul>   
  </body>
</html>

References