fava@1.22.2 vulnerabilities

Web interface for the accounting tool Beancount.

Direct Vulnerabilities

Known vulnerabilities in the fava package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

fava is a web interface for the accounting tool Beancount

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when handling tooltips in charts/bar.ts, charts/context.ts, charts/line.ts, and charts/tooltip.ts for the conversion filter on the income statement dashboard. An attacker in possession of the Beancount journal name and the base URL in use can exploit this vulnerability.

How to fix Cross-site Scripting (XSS)?

Upgrade fava to version 1.22.3 or higher.