CVE-2020-7741

Published October 6th, 2020

View on NVD ↗

CVSS v3

9.9

CRITICAL

CVSS v2

7.5

HIGH

Affected

PROJECT

Description

This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).

MrSwitch/hello.js

A Javascript RESTFUL API library for connecting with OAuth2 services, such as Google+ API, Facebook Graph and Windows Live Connect

GitHub

4.63K