org.webjars.bower:linkifyjs@1.1.7 vulnerabilities

latest version

2.1.8

first published

10 years ago

latest version published

6 years ago

licenses detected

MIT
[1.1.7,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.bower:linkifyjs package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Prototype Pollution org.webjars.bower:linkifyjs is a Find URLs, email addresses, #hashtags and @mentions in plain-text strings, then convert them into HTML links. Affected versions of this package are vulnerable to Prototype Pollution via the internal `assign()` helper due to improper filtering of the `__proto__` property. An attacker can achieve Stored or Reflected XSS by injecting event handlers into generated links. How to fix Prototype Pollution? A fix was pushed into the `master` branch but not yet published.	[0,)

Prototype Pollution

org.webjars.bower:linkifyjs is a Find URLs, email addresses, #hashtags and @mentions in plain-text strings, then convert them into HTML links.

Affected versions of this package are vulnerable to Prototype Pollution via the internal assign() helper due to improper filtering of the __proto__ property. An attacker can achieve Stored or Reflected XSS by injecting event handlers into generated links.

How to fix Prototype Pollution?

A fix was pushed into the master branch but not yet published.

[0,)

Go back to all versions of this package