{"id":"GHSA-cfxh-frx4-9gjg","aliases":[],"status":"published","title":"Cross-site Scripting in @spscommerce/ds-react","description":"### Impact\nXSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS. \n\n### Patches\nThe code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher\n\n### Workarounds\nThis is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended.\n\n### References\nhttps://github.com/SPSCommerce/woodland/blob/c49e999f97f3c0b56502859f4de1e8c6666dd74d/packages/ds-react/src/option-list/SpsOptionList.tsx#L559","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-12-15T03:13:18Z","modified":"2023-12-15T11:16:13Z","fixes":[{"ecosystem":"npm","package":"@spscommerce/ds-react","fixed_in":["7.17.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@spscommerce/ds-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.2"},{"fixed":"7.17.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@spscommerce/ds-react","ranges":[{"type":"SEMVER","events":[{"introduced":"4.12.2"},{"fixed":"7.17.4"}]}]}],"references":[{"url":"https://github.com/SPSCommerce/woodland/security/advisories/GHSA-cfxh-frx4-9gjg","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cfxh-frx4-9gjg"},{"url":"https://github.com/SPSCommerce/woodland","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-cfxh-frx4-9gjg","title":"Cross-site Scripting in @spscommerce/ds-react","description":"### Impact\nXSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS. \n\n### Patches\nThe code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher\n\n### Workarounds\nThis is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended.\n\n### References\nhttps://github.com/SPSCommerce/woodland/blob/c49e999f97f3c0b56502859f4de1e8c6666dd74d/packages/ds-react/src/option-list/SpsOptionList.tsx#L559\n","status":"published","published":"2023-12-15T03:13:18Z","modified":"2023-12-15T11:16:13Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:26.012325Z"}],"osv":[{"id":"GHSA-cfxh-frx4-9gjg","title":"Cross-site Scripting in @spscommerce/ds-react","description":"### Impact\nXSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS. \n\n### Patches\nThe code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher\n\n### Workarounds\nThis is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended.\n\n### References\nhttps://github.com/SPSCommerce/woodland/blob/c49e999f97f3c0b56502859f4de1e8c6666dd74d/packages/ds-react/src/option-list/SpsOptionList.tsx#L559\n","status":"published","published":"2023-12-15T03:13:18Z","modified":"2023-12-15T03:13:18Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}