MediumGHSA-vvm3-rv48-j3g5
Zendframework Potential XSS or HTML Injection vector in Zend_Json
Published 7 Jun 2024 · Updated 7 Jun 2024
Affected packages
zendframework/zendframework1Composer
- Affected
- >=1.7.0 <1.7.9
- Fixed in
- 1.7.9
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.7.9zendframework/zendframework1Composer
- Affected
- >=1.8.0 <1.8.5
- Fixed in
- 1.8.5
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.8.5zendframework/zendframework1Composer
- Affected
- >=1.9.0 <1.9.7
- Fixed in
- 1.9.7
Update to the fixed version for your release line, for example:
composer require zendframework/zendframework1:^1.9.7Details
Zend_Json_Encoder was not taking into account the solidus character (/) during encoding, leading to incompatibilities with the JSON specification, and opening the potential for XSS or HTML injection attacks when returning HTML within a JSON string.
Is GHSA-vvm3-rv48-j3g5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected zendframework/zendframework1, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.