Pretty Photo Dom XSS

Summary

The issue was raised in order to draw attention to the fact

1. New version with fixes was available on the official repository but still was not present in jsdeliver after multiple days, so if anyone wanted to use it they were stuck with older version.
2. To Understand what can be done so that people don't use this vulnerable piece of code.

On one side i agree that the security issue is not with jsDelivr but on the other side jsDelivr becomes a tool for causing the issues. I agree with the finding that this is a non issue for jsDelivr as a site. Its just that the customers are impacted coz they are using vulnerable version of the javascript originating from your end.

However there are other concerns about the website functionality all together. On one side its claimed that the users should use newer version on the other side as the documented bug reports on github point to the fact that they rely soly on someone else to provide them the update. Is it not a due deligence requirement of the website to ensure new versions are made available. Even if a user wanted to use the new version it was not available on the website.

Besides this although new is what should be used is it not something like a no brainer to put a notice on website if someone selects an older version that this is vulnerable and not to used or just deprecated.

The aim of the issue was never to earn bounty but rather to have a conversation to identify what could be done.