CVE-2022-1291: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

April 11, 2022 (updated April 22, 2022)

XSS vulnerability with default onCellHtmlData function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers

References

github.com/advisories/GHSA-j636-crp3-m584
github.com/hhurz/tableexport.jquery.plugin/commit/dcbaee23cf98328397a153e71556f75202988ec9
huntr.dev/bounties/49a14371-6058-47dd-9801-ec38a7459fc5
nvd.nist.gov/vuln/detail/CVE-2022-1291

Code Behaviors & Features

Detect and mitigate CVE-2022-1291 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →