GHSA-g9wg-wq4f-2x5w
Cross-Site Scripting in console-feed
GHSA-g9wg-wq4f-2x5w is a vulnerability with no CVSS score yet in console-feed, published September 3, 2020. No source lists public exploit code. Fixed in console-feed 2.8.10.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.8.10console-feed
Description
Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses console-feed and a malicious JavaScript payload was passed to a console.log('%_', payload) call, the package would render HTML containing the malicious payload.
Recommendation
Upgrade to version 2.8.10 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
console-feednpm | before 2.8.10 | 2.8.10 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in console-feed
Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses console-feed and a malicious JavaScript payload was passed to a console.log('%_', payload) call, the package would render HTML containing the malicious payload.
Recommendation
Upgrade to version 2.8.10 or later.
- Record
GHSA-g9wg-wq4f-2x5w- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in console-feed
Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses console-feed and a malicious JavaScript payload was passed to a console.log('%_', payload) call, the package would render HTML containing the malicious payload.
Recommendation
Upgrade to version 2.8.10 or later.
- Record
GHSA-g9wg-wq4f-2x5w- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.