CVE-2022-1330: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

April 13, 2022 (updated April 22, 2022)

Stored XSS due to unsantized anchor URL in fullpage.js.

References

github.com/advisories/GHSA-h3cq-j957-vhxg
github.com/alvarotrigo/fullPage.js/pull/4360
github.com/alvarotrigo/fullpage.js/commit/e7a5db42711700c8a584e61b5e532a64039fe92b
huntr.dev/bounties/08d2a6d0-772f-4b05-834e-86343f263c35
nvd.nist.gov/vuln/detail/CVE-2022-1330

Code Behaviors & Features

Detect and mitigate CVE-2022-1330 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →