HTML Injection in shout · CVE-2017-16043 · GitHub Advisory Database · GitHub

HTML Injection in shout

Moderate severity GitHub Reviewed Published Nov 7, 2018 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

shout (npm)

Affected versions

>= 0.44.0, <= 0.49.3

Patched versions

0.50.0

Description

Affected versions of shout do not escape the /topic command in messages, and are therefore vulnerable to cross-site scripting.

Recommendation

Update to version 0.50.0 or later.

References

Published to the GitHub Advisory Database Nov 7, 2018

Reviewed Jun 16, 2020

Last updated Jan 9, 2023