VulnerabilityModified
CVE-2022-25854
The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
MEDIUM 5.4EPSS 0.98%
Does this matter?
Lower severity and a low EPSS score (0.98%). Track it; it rarely justifies an emergency change on its own.
Description
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.98% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- tagify project/tagify
- Source
- report@snyk.io
References
- https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/Exploit, Patch, Third Party Advisory
- https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7Patch, Third Party Advisory
- https://github.com/yairEO/tagify/issues/988Exploit, Issue Tracking, Third Party Advisory
- https://github.com/yairEO/tagify/releases/tag/v4.9.8Release Notes, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358Third Party Advisory
- https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/Exploit, Patch, Third Party Advisory
- https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7Patch, Third Party Advisory
- https://github.com/yairEO/tagify/issues/988Exploit, Issue Tracking, Third Party Advisory
- https://github.com/yairEO/tagify/releases/tag/v4.9.8Release Notes, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.