{"id":"CVE-2018-18282","details":"Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.","aliases":["GHSA-qw96-mm2g-c8m7"],"modified":"2026-08-27T08:14:27.783307Z","published":"2018-10-12T22:29:00.763Z","references":[{"type":"ADVISORY","url":"https://github.com/zeit/next.js/releases/tag/7.0.2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vercel/next.js","events":[{"introduced":"3a059688a8a0e10342ce697c89a7faebbeca9629"},{"last_affected":"ae56c7847f32173c0c6954a124fdaa749d44b5dc"},{"fixed":"45c554a3283dfa7ab2dc007f5f03883c738a4b58"}],"database_specific":{"cpe":["cpe:2.3:a:zeit:next.js:7.0.0:*:*:*:*:*:*:*","cpe:2.3:a:zeit:next.js:7.0.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.0.1"},{"last_affected":"7.0.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["7.0.0","7.0.1","7.0.1-canary.6","7.0.1-canary.5","7.0.1-canary.4","7.0.1-canary.3","7.0.1-canary.2","7.0.1-canary.1","7.0.1-canary.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18282.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}