CVE-2019-12313
Cross-Site Scripting in shave
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
- Record
CVE-2019-12313- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
- Record
CVE-2019-12313- Updated
- 2026-11-02
EUVDEUVD-2019-0465 No score
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
- Record
EUVD-2019-0465- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gh4g-3gm9-5wrq
Cross-Site Scripting in shave
Versions of shave prior to 2.5.3 are vulnerable to Cross-Site Scripting. The shave package overwrites HTML elements and in doing so fails to properly encode the output. If encoded HTML input is passed into shave the output will be decoded which may lead to Cross-Site Scripting.
Recommendation
Upgrade to version 2.5.3 or later.
- Record
GHSA-gh4g-3gm9-5wrq- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
- Record
CVE-2019-12313- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-gh4g-3gm9-5wrq
Cross-Site Scripting in shave
Versions of shave prior to 2.5.3 are vulnerable to Cross-Site Scripting. The shave package overwrites HTML elements and in doing so fails to properly encode the output. If encoded HTML input is passed into shave the output will be decoded which may lead to Cross-Site Scripting.
Recommendation
Upgrade to version 2.5.3 or later.
- Record
GHSA-gh4g-3gm9-5wrq- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shavenpm |
before 2.5.3 | 2.5.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12313 is a medium vulnerability (CVSS 6.1) in Dollarshaveclub Shave, published May 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in shave 2.5.3.