org.webjars:yui@2.6.0 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.webjars:yui package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

yui is an open source JavaScript and CSS framework for building richly interactive web applications.

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) via YUI .swf files, allowing arbitrary code injection into the hosting server.

How to fix Cross-site Scripting (XSS)?

Upgrade yui to version 2.8.2 or higher.

[2.4.0,2.8.2)
  • M
Cross-site Scripting (XSS)

yui is an open source JavaScript and CSS framework for building richly interactive web applications. Affected versions of the package are vulnerable to Cross-site Scripting (XSS) via .swf files, allowing arbitrary code injection into the hosting server.

Notes:

  • If your site loads YUI 2 from a CDN (yui.yahooapis.com, ajax.googleapis.com, etc.) and not from your own domain, you are not affected.
  • YUI 3 is not affected by this issue.
  • Whether or not your site uses the affected components, simply hosting an affected file means you are vulnerable.

This vulnerability is similar to CVE-2010-4207.

How to fix Cross-site Scripting (XSS)?

Upgrade yui to version 3.0.0 or higher.

[2.4.0,3.0.0)