GHSA-w4vp-3mq7-7v82
Cross-Site Scripting in lazysizes
GHSA-w4vp-3mq7-7v82 is a vulnerability with no CVSS score yet in lazysizes, published September 3, 2020. No source lists public exploit code. Fixed in lazysizes 5.2.1-rc1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.2.1-rc1lazysizes +1 more
Description
Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes.
Recommendation
Upgrade to version 5.2.1-rc1 or later.
Affected packages
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in lazysizes
Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes.
Recommendation
Upgrade to version 5.2.1-rc1 or later.
- Record
GHSA-w4vp-3mq7-7v82- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in lazysizes
Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes.
Recommendation
Upgrade to version 5.2.1-rc1 or later.
- Record
GHSA-w4vp-3mq7-7v82- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.