MediumGHSA-389c-cf87-qmwjCVE-2024-21504
Cross-site Scripting in livewire/livewire
Published 19 Mar 2024 · Updated 20 Mar 2024
Affected package
livewire/livewireComposer
- Affected
- >=3.3.5 <3.4.9
- Fixed in
- 3.4.9
Update to the fixed version for your release line, for example:
composer require livewire/livewire:^3.4.9Details
Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it.
Is GHSA-389c-cf87-qmwj in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected livewire/livewire, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-21504
- Linkgithub.com/livewire/livewire/pull/8117
- Linkgithub.com/livewire/livewire/commit/c65b3f0798ab2c9338213ede3588c3cdf4e6fcc0
- Packagegithub.com/livewire/livewire
- Linkgithub.com/livewire/livewire/releases/tag/v3.4.9
- Linksecurity.snyk.io/vuln/SNYK-PHP-LIVEWIRELIVEWIRE-6446222
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.