CVE-2023-3481: XSS in Chrome Lab Critters
First published: Fri Aug 11 2023(Updated: )
### Impact Critters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) bug. ### Patches The bug has been fixed in `v0.0.20`. ### Workarounds Upgrading Critters version to `>0.0.20` is the easiest fix. This is a non breaking version upgrade so we recommend all users to use `v0.0.20`.
Credit: cve-coordination@google.com cve-coordination@google.com cve-coordination@google.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Critters | >=0.0.17<=0.0.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597
- https://github.com/GoogleChromeLabs/critters/pull/133
- https://github.com/GoogleChromeLabs/critters/commit/7757902c9e0b3285d516359b3cb602cd9d50d80e
- https://nvd.nist.gov/vuln/detail/CVE-2023-3481
- https://github.com/advisories/GHSA-cx3j-qqxj-9597 (Advisory)
- collector/nvd-api
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-cx3j-qqxj-9597
- alias/CVE-2023-3481
- collector/github-advisory
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/author
- agent/title
- agent/severity
- agent/description
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/google
- canonical/google critters
- version/google critters/0.0.17
- version/google critters/0.0.19
- package-manager/npm