CVE-2021-35440: Cross-site Scripting

July 6, 2021 (updated July 7, 2021)

Smashing is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim’s computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL’s for deploying, or cookies that are very permissive) private information may be retrieved by the attacker.

References

nvd.nist.gov/vuln/detail/CVE-2021-35440

Code Behaviors & Features

Detect and mitigate CVE-2021-35440 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →