CVE-2021-43785: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

November 26, 2021 (updated November 30, 2021)

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. There are two vectors for XSS attacks, a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a script tag into the page and execute malicious code.

References

github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16
github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e
github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq
nvd.nist.gov/vuln/detail/CVE-2021-43785

Code Behaviors & Features

Detect and mitigate CVE-2021-43785 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →