HTML Injection Affecting shout Open this link in a new tab package, versions <0.50.0 >=0.44.0


0.0
medium
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    npm:shout:20150122

  • published

    13 Feb 2017

  • disclosed

    21 Jan 2015

  • credit

    pangeacake

How to fix?

Upgrade shout to version 0.50.0 or higher.

Overview

shout is a self-hosted Web IRC client.

The topic message in src/plugins/irc-events/topic.js is not escaped and may allow attackers to inject arbitrary HTML scripts.