Intel

AIKIDO-2024-10232

radix-vue is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS) Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Aug 28, 2024

30

Low Risk

This Affects:

jsradix-vue
0.1.20 - 1.9.4
Fixed in 1.9.5
Are you affected? Scan for Free

TL;DR

Affected versions of the package are vulnerable to Cross-site Scripting (XSS) when custom dynamic select items are allowed.

Who does this affect?

You are affected if you are using a version which is within vulnerability ranges and allow for custom dynamic select items.

Background info

radix-vue is vulnerable to Cross-site Scripting (XSS) in versions 0.1.20 - 1.9.4.

How to fix this

Upgrade the radix-vue library to the patch version.