Skip to content

@clerk/shared@4.25.5

Choose a tag to compare

View all tags
@clerk-cookie clerk-cookie released this 16 Jul 20:05
Immutable release. Only release title and notes can be modified.
@clerk/shared@4.25.5
b37ba0d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch Changes

  • Escape <, >, and / when serializing the Clerk auth state into SSR <script> tags, preventing a </script> sequence inside user-controllable session claims from breaking out of the script element (stored XSS). The embedded JSON still parses to identical values on the client. (#9166) by @dominic-clerk
Assets 3
Loading