CVE-2024-42515: Glossarizer Cross-site Scripting vulnerability

October 31, 2024 (updated November 1, 2024)

Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying library converts these encoded characters into legitimate HTML, thereby possibly causing stored XSS. Attackers can append a XSS payload to a word that has a corresponding glossary entry.

References

github.com/PebbleRoad/glossarizer
github.com/advisories/GHSA-hhhv-ggjx-q9j2
herolab.usd.de/security-advisories/usd-2024-0011
nvd.nist.gov/vuln/detail/CVE-2024-42515
www.npmjs.com/package/glossarizer

Code Behaviors & Features

Detect and mitigate CVE-2024-42515 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →