WS-2019-0058: webpack-bundle-analyzer vulnerability
Open
ENTITY - DO NOT USE
NameX
NRO
- Dominant language
- JavaScript
- Stars
- 23
- Forks
- 62
- Avg merge
- 24m
- Merged PRs (30d)
- 1
Description
### WS-2019-0058
moderate severity
Vulnerable versions: < 3.3.2
Patched version: 3.3.2
Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify() without properly escaping input which may lead to Cross-Site Scripting.
Also Upgrade webpack-dev-server to version 3.1.11 or later.
### Remediation
Upgrade webpack-bundle-analyzer to version 3.3.2 or later. For example:
```
"dependencies": {
"webpack-bundle-analyzer": ">=3.3.2"
}
```
or…
```
"devDependencies": {
"webpack-bundle-analyzer": ">=3.3.2"
}
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.