Cross-site Scripting (XSS)
Affecting rendr package, versions <1.1.4 >=0.4.0
rendr is your Backbone.js apps on the client and the server.
Affected versions of the package are vulnerable to Cross-site Scripting (XSS).
View options are automatically unescaped whenever they are rendered to the DOM, and rendr unescapes is as well. This may allow attackers to execute XSS attacks (e.g. when displaying escaped HTML in a
These attacks are possible by escaping the context of the web application and injecting malicious scripts in an otherwise trusted website. These scripts can introduce additional attributes (say, a "new" option in a dropdown list or a new link to a malicious site) and can potentially execute code on the clients side, unbeknown to the victim. This occurs when characters like
' are not escaped properly.
There are a few types of XSS:
- Persistent XSS is an attack in which the malicious code persists into the web app’s database.
- Reflected XSS is an which the website echoes back a portion of the request. The attacker needs to trick the user into clicking a malicious link (for instance through a phishing email or malicious JS on another page), which triggers the XSS attack.
You can read more about
Cross-site Scripting (XSS) on our blog.
rendr to version 1.1.4 or higher.
Do your applications use this vulnerable package?
- Jon Merrifield
- Snyk ID
- 10 Mar, 2016
- 08 May, 2017