org.webjars:uikit@2.22.0 vulnerabilities

latest version

3.17.9

first published

11 years ago

latest version published

1 years ago

licenses detected

MIT
[2.4.0,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.webjars:uikit package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) org.webjars:uikit is a lightweight and modular front-end framework for developing fast and powerful web interfaces. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `data-caption` attribute due to insufficient input sanitisation and output escaping. An attacker can execute arbitrary web scripts in the context of another user by injecting malicious content as a user with Contributor-level access or higher. Note: The underlying 'uikit' package behavior is exposed by other packages such as 'Element Pack Addons' for Elementor plugin for WordPress. 'Element Pack Addons' has mitigated the issue in version 8.1.0. How to fix Cross-site Scripting (XSS)? There is no fixed version for `org.webjars:uikit`.	[2.18.0,)
M Regular Expression Denial of Service (ReDoS) org.webjars:uikit is a lightweight and modular front-end framework for developing fast and powerful web interfaces. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to using a hardcoded file from a vulnerable version of marked. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `org.webjars:uikit` to version 3.2.7 or higher.	[2.4.0,3.2.7)

Cross-site Scripting (XSS)

org.webjars:uikit is a lightweight and modular front-end framework for developing fast and powerful web interfaces.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the data-caption attribute due to insufficient input sanitisation and output escaping. An attacker can execute arbitrary web scripts in the context of another user by injecting malicious content as a user with Contributor-level access or higher.

Note:

The underlying 'uikit' package behavior is exposed by other packages such as 'Element Pack Addons' for Elementor plugin for WordPress. 'Element Pack Addons' has mitigated the issue in version 8.1.0.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for org.webjars:uikit.

[2.18.0,)

Regular Expression Denial of Service (ReDoS)

org.webjars:uikit is a lightweight and modular front-end framework for developing fast and powerful web interfaces.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to using a hardcoded file from a vulnerable version of marked.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade org.webjars:uikit to version 3.2.7 or higher.

[2.4.0,3.2.7)

Go back to all versions of this package