{"id":"CVE-2020-7741","aliases":["EUVD-2021-0496","GHSA-7jh9-6cpf-h4m7","SNYK-JS-HELLOJS-1014546"],"status":"published","title":"Cross-site Scripting (XSS)","description":"This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01476,"percentile":0.74033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-10-06T14:30:15Z","modified":"2026-10-20T10:54:24Z","fixes":[{"ecosystem":"npm","package":"hellojs","fixed_in":["1.18.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hellojs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.6"}]}]},{"source":"osv","ecosystem":"npm","package":"hellojs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.6"}]}]}],"products":[{"vendor":"hello.js_project","product":"hello.js"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/MrSwitch/hello.js/blob/3b79ec93781b3d7b9c0b56f598e060301d1f3e73/dist/hello.all.js%23L1545","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7741","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7jh9-6cpf-h4m7"}],"sources":{"cve":[{"id":"CVE-2020-7741","title":"Cross-site Scripting (XSS)","description":"This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).","status":"published","published":"2020-10-06T14:30:15.993Z","modified":"2024-09-16T16:42:49.723Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2021-0496","description":"This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).","status":"published","published":"2020-10-06T14:30:15Z","modified":"2024-09-16T16:42:49Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:49.07001Z"}],"ghsa":[{"id":"GHSA-7jh9-6cpf-h4m7","title":"XSS in hello.js","description":"This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as `javascript:alert(1)`.","status":"published","published":"2021-01-13T19:07:01Z","modified":"2023-09-12T18:13:25Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:04.447845Z"}],"nvd":[{"id":"CVE-2020-7741","description":"This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).","status":"published","published":"2020-10-06T15:15:15.757Z","modified":"2026-06-17T03:25:21.75Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:17.70091Z"}],"osv":[{"id":"CVE-2020-7741","description":"This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).","status":"published","published":"2020-10-06T15:15:15.757Z","modified":"2026-10-20T10:54:24.525885242Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"GHSA-7jh9-6cpf-h4m7","title":"XSS in hello.js","description":"This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as `javascript:alert(1)`.","status":"published","published":"2021-01-13T19:07:01Z","modified":"2026-07-08T06:49:36.561801408Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}