MediumGHSA-j543-vg33-g6vj
ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor`
Published 7 Jun 2024 · Updated 7 Jun 2024
Affected packages
zendframework/zendframework1Composer
- Affected
- >=1.7.0 <1.7.9
- Fixed in
- 1.7.9
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.7.9zendframework/zendframework1Composer
- Affected
- >=1.8.0 <1.8.5
- Fixed in
- 1.8.5
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.8.5zendframework/zendframework1Composer
- Affected
- >=1.9.0 <1.9.7
- Fixed in
- 1.9.7
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.9.7Details
Zend_Dojo_View_Helper_Editor was incorrectly decorating a TEXTAREA instead of a DIV. The Dojo team has reported that this has security implications as the rich text editor they use is unable to escape content for a TEXTAREA.
Is GHSA-j543-vg33-g6vj in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected zendframework/zendframework1, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.