AIKIDO-2024-10006
@stencil/core is vulnerable to CSS injection
7
Low Risk
This Affects:
@stencil/coreTL;DR
Affected versions of this package present a security risk due to the use of innerHTML for injecting CSS into <style> elements in bootstrap-lazy.ts. Switching to textContent mitigates the risk of executing malicious scripts. This is considered a low-risk issue, as most browser extensions block such behavior by default.
Who does this affect?
You are affected by this flaw if you use a version >= 4.7.2 and = 4.12.2 of this package.
Background info
@stencil/core is vulnerable to CSS injection in versions 4.7.2 - 4.12.2.
How to fix this
To fix, upgrade to version 4.12.3 or above.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.