{"id":"GHSA-pgr8-jg6h-8gw6","summary":"Cross-Site Scripting in webpack-bundle-analyzer","details":"Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting.\n\n\n## Recommendation\n\nUpgrade to version 3.3.2 or later.","modified":"2021-08-04T15:26:36Z","published":"2019-05-23T09:26:20Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2019-05-23T07:34:50Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263"},{"type":"WEB","url":"https://github.com/webpack-contrib/webpack-bundle-analyzer/pull/264"},{"type":"WEB","url":"https://github.com/webpack-contrib/webpack-bundle-analyzer/commit/20f2b4c553ee343f491faf63e39427fba9908c7c"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-WEBPACKBUNDLEANALYZER-174190"},{"type":"WEB","url":"https://www.npmjs.com/advisories/826"}],"affected":[{"package":{"name":"webpack-bundle-analyzer","ecosystem":"npm","purl":"pkg:npm/webpack-bundle-analyzer"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-pgr8-jg6h-8gw6/GHSA-pgr8-jg6h-8gw6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"}]}