CVE-2023-32325: Cross-site scripting in PostHog-js
First published: Mon May 22 2023(Updated: )
### Impact Potential for cross-site scripting in `posthog-js`. ### Patches The problem has been patched in `posthog-js` version 1.57.2. ### Workarounds - This isn't an issue for sites that have a Content Security Policy in place. - Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version. ### References We will publish details of the vulnerability in 30 days as per our [security policy](https://posthog.com/handbook/company/security#policies).
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/posthog-js | <1.57.2 | 1.57.2 |
| Posthog | <1.57.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/PostHog/posthog-js/commit/67e07eb8bb271a3a6f4aa251382e4d25abb385a0
- https://github.com/PostHog/posthog-js/security/advisories/GHSA-8775-5hwv-wr6v
- https://github.com/PostHog/posthog-js/pull/630
- https://nvd.nist.gov/vuln/detail/CVE-2023-32325
- https://github.com/advisories/GHSA-8775-5hwv-wr6v (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-32325.
What is the impact of this vulnerability?
This vulnerability has the potential for cross-site scripting in `posthog-js`.
How can I fix this vulnerability?
To fix this vulnerability, update `posthog-js` to version 1.57.2 or later.
Are there any workarounds for this vulnerability?
Yes, you can mitigate this vulnerability by implementing a Content Security Policy.
What is the severity level of this vulnerability?
The severity level of this vulnerability is medium (6.1).
- collector/github-advisory-latest
- alias/GHSA-8775-5hwv-wr6v
- alias/CVE-2023-32325
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/title
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-latest
- collector/nvd-index
- package-manager/npm
- vendor/posthog
- canonical/posthog