{"id":"GHSA-9xr8-8hmc-389f","aliases":[],"status":"published","title":"Cross-Site Scripting in vant","description":"Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.1.8 or later.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-11-22T13:45:33Z","modified":"2023-01-09T05:02:04Z","fixes":[{"ecosystem":"npm","package":"vant","fixed_in":["2.1.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8"}]}]},{"source":"osv","ecosystem":"npm","package":"vant","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.8"}]}]}],"references":[{"url":"https://github.com/youzan/vant/issues/4270","tags":["web"]},{"url":"https://github.com/youzan/vant/pull/4278/commits/d777b78c7dc2c904f474d057ea88449cfe2ca13a","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1157","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-VANT-460461","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9xr8-8hmc-389f"}],"sources":{"ghsa":[{"id":"GHSA-9xr8-8hmc-389f","title":"Cross-Site Scripting in vant","description":"Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.1.8 or later.","status":"published","published":"2019-11-22T13:45:33Z","modified":"2023-01-09T05:02:04Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-9xr8-8hmc-389f","title":"Cross-Site Scripting in vant","description":"Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.1.8 or later.","status":"published","published":"2019-11-22T13:45:33Z","modified":"2021-08-18T22:47:15Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}