{"id":"GHSA-c53x-wwx2-pg96","aliases":[],"status":"published","title":"Cross-Site Scripting in @berslucas/liljs","description":"Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.0.2 or later.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-09-03T17:03:58Z","modified":"2023-01-09T05:03:38Z","fixes":[{"ecosystem":"npm","package":"@berslucas/liljs","fixed_in":["1.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@berslucas/liljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@berslucas/liljs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-BERSLUCASLILJS-450217","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1016","tags":["web"]},{"url":"https://github.com/bersLucas/liljs/pull/7","tags":["web"]},{"url":"https://github.com/bersLucas/liljs/commit/779c0dcd8aba434a1c94db7d1d2d990a629f9a6c","tags":["web"]},{"url":"https://github.com/bersLucas/liljs/releases/tag/1.0.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c53x-wwx2-pg96"},{"url":"https://github.com/bersLucas/liljs","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-c53x-wwx2-pg96","title":"Cross-Site Scripting in @berslucas/liljs","description":"Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.0.2 or later.","status":"published","published":"2020-09-03T17:03:58Z","modified":"2023-01-09T05:03:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"osv":[{"id":"GHSA-c53x-wwx2-pg96","title":"Cross-Site Scripting in @berslucas/liljs","description":"Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.0.2 or later.","status":"published","published":"2020-09-03T17:03:58Z","modified":"2021-09-28T17:27:43Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}