CVE-2020-7691: Cross-site Scripting (XSS)
Published Jul 6, 2020
·Updated
In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.
Other sources
It's possible to use nested script tags in order to bypass the filtering regex.
Affected Software
2 affected componentsFixes available
npm/jspdf<2.0.0
2.0.0
parall jspdf Node.js
Event History
Jul 6, 2020
CVE Published
via MITRE·12:25 PM
Data Sourced
via MITRE·12:25 PM
DescriptionSeverityWeakness
May 11, 2021
Advisory Published
04:43 PM
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-7691.
2
What is the severity of CVE-2020-7691?
The severity of CVE-2020-7691 is medium.
3
Which package is affected by CVE-2020-7691?
The package affected by CVE-2020-7691 is jspdf.
4
How can the filtering regex be bypassed in this vulnerability?
The filtering regex can be bypassed in this vulnerability by using nested script tags.
5
Is there a fix available for CVE-2020-7691?
Yes, the fix for CVE-2020-7691 is included in version 2.0.0 of the jspdf package.