CVE-2022-1726: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 17, 2022 (updated May 25, 2022)

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.

References

github.com/advisories/GHSA-grw5-g9h2-wpg8
github.com/wenzhixin/bootstrap-table/commit/b4a1e5dd332be652e0bc376fd9256886cf4bbde9
huntr.dev/bounties/9b85cc33-0395-4c31-8a42-3a94beb2efea
nvd.nist.gov/vuln/detail/CVE-2022-1726

Code Behaviors & Features

Detect and mitigate CVE-2022-1726 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →