Skip to content

ansi_up cross-site scripting vulnerability

Moderate severity GitHub Reviewed Published Mar 11, 2021 to the GitHub Advisory Database • Updated Sep 13, 2023

Package

npm ansi_up (npm)

Affected versions

< 5.0.0

Patched versions

5.0.0

Description

The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.

References

Published by the National Vulnerability Database Mar 5, 2021
Reviewed Mar 11, 2021
Published to the GitHub Advisory Database Mar 11, 2021
Last updated Sep 13, 2023

Severity

Moderate
6.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS score

0.129%
(48th percentile)

Weaknesses

CVE ID

CVE-2021-3377

GHSA ID

GHSA-2v5f-23xc-v9qr

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.