Cxf0b588a3-5c6f @ Npm-jquery-1.6.4

[smaguilarcx]

Vulnerable Package issue exists @ Npm-jquery-1.6.4 in branch master

The package jQuery before 1.12.0, between 1.12.2 and 2.1.4 and between 2.2.2 and 2.2.4 is vulnerable to XSS. The function jQuery.parseHTML() in the file src/core/parseHTML.js doesn't stop scripts or inline event handlers from being executed immediately, which could result in XSS as the attacker could embed malicious scripts in the HTML (img nodes with embedded src url's which are pre-loaded when the page is requested) which would get executed immediately in the victim's browser even without user's intervention.

Namespace: CxDemoInABoxRepos
Repository: BodgeitIssue
Repository Url: https://github.com/CxDemoInABoxRepos/BodgeitIssue
CxAST-Project: CxDemoInABoxRepos/BodgeitIssue
CxAST platform scan: eed07198-d1ae-46bb-80fc-88cbc7cbac3c
Branch: master
Application: BodgeitIssue
Severity: MEDIUM
State: NOT_IGNORED
Status: NEW
CWE: CWE-79

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: LOW
Availability impact: NONE
Remediation Upgrade Recommendation: 1.12.0

---

References
Issue
Pull request
Commit
Pull request
Commit