joeattardi/picmo

joeattardi/picmo

GitHubGitHub
GitHubgithub.com
picmojs.compicmojs.com
Releases110
Frequency1 week 5 days
Last Release
Stars1.19K
JavaScript emoji picker. Any app, any framework.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2021-43785↗
7.6 HIGH4.3 MEDIUM

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.