{"id":"GHSA-87mg-h5r3-hw88","aliases":[],"status":"published","title":"Cross-Site Scripting in bootbox","description":"All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.\n\n\n## Recommendation\n\nSanitize user input being passed to `bootbox` or consider using an alternative package.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-64","CWE-79"],"published":"2019-05-30T17:23:28Z","modified":"2023-01-09T05:01:21Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"bootbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"bootbox","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"5.5.2"}]}]}],"references":[{"url":"https://github.com/makeusabrew/bootbox/issues/661","tags":["web"]},{"url":"https://hackerone.com/reports/508446","tags":["web"]},{"url":"https://www.npmjs.com/advisories/882","tags":["web"]},{"url":"https://github.com/advisories/GHSA-87mg-h5r3-hw88"},{"url":"https://github.com/makeusabrew/bootbox","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-87mg-h5r3-hw88","title":"Cross-Site Scripting in bootbox","description":"All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.\n\n\n## Recommendation\n\nSanitize user input being passed to `bootbox` or consider using an alternative package.","status":"published","published":"2019-05-30T17:23:28Z","modified":"2023-01-09T05:01:21Z","cwes":["CWE-64","CWE-79"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-87mg-h5r3-hw88","title":"Cross-Site Scripting in bootbox","description":"All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.\n\n\n## Recommendation\n\nSanitize user input being passed to `bootbox` or consider using an alternative package.","status":"published","published":"2019-05-30T17:23:28Z","modified":"2021-09-16T21:01:13Z","cwes":["CWE-64","CWE-79"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}