Linux Foundation Decentralized Trust · Report #1670187

Cross Site Scripting Vulnerability in fabric-sdk-py source code

Informativestatus

9upvotes

17 Aug 2022disclosed

How it was found

See this fix on GitHub https://github.com/hyperledger/fabric-sdk-py/pull/175

Impact

Some old affected versions of this package are vulnerable to Cross-site Scripting (XSS). Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original