Security Digest · Critical advisory (no CVE assigned)
GHSA-cfxh-frx4-9gjg: Cross-site Scripting in @spscommerce/ds-react
Impact XSS, anyone using the SPS Select with options prop populated from user input is impacted.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
npm audit (or: npm ls <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| npm | @spscommerce/ds-react | >= 4.12.2, < 7.17.4 | 7.17.4 |
Details
Impact XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS.
Patches The code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher
Workarounds This is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended.
References https://github.com/SPSCommerce/woodland/blob/c49e999f97f3c0b56502859f4de1e8c6666dd74d/packages/ds-react/src/option-list/SpsOptionList.tsx#L559
Sources and references
- GitHub Advisory GHSA-cfxh-frx4-9gjg github.com
- github.com github.com