Homepage
About Snyk

fava@1.22.2 vulnerabilities

Web interface for the accounting tool Beancount.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the fava package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

fava is a web interface for the accounting tool Beancount

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when handling tooltips in charts/bar.ts, charts/context.ts, charts/line.ts, and charts/tooltip.ts for the conversion filter on the income statement dashboard. An attacker in possession of the Beancount journal name and the base URL in use can exploit this vulnerability.

How to fix Cross-site Scripting (XSS)?

Upgrade fava to version 1.22.3 or higher.

[,1.22.3)
Go back to all versions of this package