CVE-2021-43785 — Cross Site Scripting Vulnerability in @joeattardi/emoji-button
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string…
Published: 2021-11-26 · CVSS: 7.6 · CVSS 3.1
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7