You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: repository/jsrepository-master.json
+163-6Lines changed: 163 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -11160,7 +11160,36 @@
11160
11160
]
11161
11161
},
11162
11162
"video.js": {
11163
-
"vulnerabilities": [],
11163
+
"vulnerabilities": [
11164
+
{
11165
+
"ranges": [
11166
+
{
11167
+
"atOrAbove": "0",
11168
+
"below": "7.14.3"
11169
+
}
11170
+
],
11171
+
"summary": "This affects the package video.js before 7.14.3.\n The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.\n\n",
"summary": "A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted `onloadstart` attribute of an IMG element) in a text field. No patch exists and no further releases are planned.\n\nThis CVE is disputed. Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser. More information can be found [here](https://github.com/quilljs/quill/issues/3364).",
"summary": "Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
11247
+
"identifiers": {
11248
+
"githubID": "GHSA-588m-9qg5-35pq"
11249
+
},
11250
+
"severity": "medium",
11251
+
"cwe": [
11252
+
"CWE-1022"
11253
+
],
11254
+
"info": [
11255
+
"https://github.com/quilljs/quill/issues/2438",
11256
+
"https://github.com/quilljs/quill/pull/2674",
11257
+
"https://www.npmjs.com/advisories/1039"
11258
+
]
11259
+
},
11260
+
{
11261
+
"ranges": [
11262
+
{
11263
+
"atOrAbove": "2.0.3",
11264
+
"below": "2.0.4"
11265
+
}
11266
+
],
11267
+
"summary": "A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.",
"summary": "### Summary\nA prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2\n\n### Details\nThe vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n#### Steps to reproduce\n1. Install latest version of swiper using npm install \n2. Run the following code snippet:\n```javascript\nvar swiper = require('swiper');\nArray.prototype.indexOf = () => -1; \nlet obj = {};\nvar malicious_payload = '{\"__proto__\":{\"polluted\":\"yes\"}}';\nconsole.log({}.polluted);\nswiper.default.extendDefaults(JSON.parse(malicious_payload));\nconsole.log({}.polluted); // prints yes -> indicating that the patch was bypassed and prototype pollution occurred\n```\n\n#### Expected behavior\nPrototype pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a prototype pollution vulnerability, which can have severe security implications depending on how swiper is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.\nIt could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service - Even if an attacker is not able to exploit prototype pollution in swiper, if there is a prototype pollution within the project from other dependencies, modifying global `Array.prototype.indexOf` property can result in crash when swiper.default.extendDefaults is called because swiper makes use of this global property. This can lead to Denial of Service. \n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)\n\n### Related CVEs\n[CVE-2026-25521](https://github.com/advisories/GHSA-rxrv-835q-v5mh)\n[CVE-2026-25047](https://github.com/advisories/GHSA-2733-6c58-pf27)\n[CVE-2026-26021](https://github.com/advisories/GHSA-2c4m-g7rx-63q7)",
Copy file name to clipboardExpand all lines: repository/jsrepository-v2.json
+133-3Lines changed: 133 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -12927,7 +12927,32 @@
12927
12927
}
12928
12928
},
12929
12929
"video.js": {
12930
-
"vulnerabilities": [],
12930
+
"vulnerabilities": [
12931
+
{
12932
+
"atOrAbove": "0",
12933
+
"below": "7.14.3",
12934
+
"severity": "medium",
12935
+
"cwe": [
12936
+
"CWE-79"
12937
+
],
12938
+
"identifiers": {
12939
+
"summary": "This affects the package video.js before 7.14.3.\n The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.\n\n",
"summary": "Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
12982
+
"githubID": "GHSA-588m-9qg5-35pq"
12983
+
},
12984
+
"info": [
12985
+
"https://github.com/quilljs/quill/issues/2438",
12986
+
"https://github.com/quilljs/quill/pull/2674",
12987
+
"https://www.npmjs.com/advisories/1039"
12988
+
]
12989
+
},
12990
+
{
12991
+
"atOrAbove": "0",
12992
+
"below": "1.3.8",
12993
+
"severity": "medium",
12994
+
"cwe": [
12995
+
"CWE-79"
12996
+
],
12997
+
"identifiers": {
12998
+
"summary": "A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted `onloadstart` attribute of an IMG element) in a text field. No patch exists and no further releases are planned.\n\nThis CVE is disputed. Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser. More information can be found [here](https://github.com/quilljs/quill/issues/3364).",
"summary": "A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.",
13022
+
"githubID": "GHSA-v3m3-f69x-jf25",
13023
+
"CVE": [
13024
+
"CVE-2025-15056"
13025
+
]
13026
+
},
13027
+
"info": [
13028
+
"https://fluidattacks.com/advisories/diomedes"
13029
+
]
13030
+
}
13031
+
],
12948
13032
"extractors": {
12949
13033
"filename": [
12950
13034
"quill-(§§version§§)(?:\\.min)?\\.js"
@@ -12959,7 +13043,53 @@
12959
13043
}
12960
13044
},
12961
13045
"swiper": {
12962
-
"vulnerabilities": [],
13046
+
"vulnerabilities": [
13047
+
{
13048
+
"atOrAbove": "0",
13049
+
"below": "6.5.1",
13050
+
"severity": "critical",
13051
+
"cwe": [
13052
+
"CWE-1321"
13053
+
],
13054
+
"identifiers": {
13055
+
"summary": "Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.",
"summary": "### Summary\nA prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2\n\n### Details\nThe vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n#### Steps to reproduce\n1. Install latest version of swiper using npm install \n2. Run the following code snippet:\n```javascript\nvar swiper = require('swiper');\nArray.prototype.indexOf = () => -1; \nlet obj = {};\nvar malicious_payload = '{\"__proto__\":{\"polluted\":\"yes\"}}';\nconsole.log({}.polluted);\nswiper.default.extendDefaults(JSON.parse(malicious_payload));\nconsole.log({}.polluted); // prints yes -> indicating that the patch was bypassed and prototype pollution occurred\n```\n\n#### Expected behavior\nPrototype pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a prototype pollution vulnerability, which can have severe security implications depending on how swiper is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.\nIt could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service - Even if an attacker is not able to exploit prototype pollution in swiper, if there is a prototype pollution within the project from other dependencies, modifying global `Array.prototype.indexOf` property can result in crash when swiper.default.extendDefaults is called because swiper makes use of this global property. This can lead to Denial of Service. \n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)\n\n### Related CVEs\n[CVE-2026-25521](https://github.com/advisories/GHSA-rxrv-835q-v5mh)\n[CVE-2026-25047](https://github.com/advisories/GHSA-2733-6c58-pf27)\n[CVE-2026-26021](https://github.com/advisories/GHSA-2c4m-g7rx-63q7)",
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments