CVE-2024-23841: XSS in @apollo/experimental-nextjs-app-support
Impact
The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this vulnerability, we implemented appropriate escaping to prevent javascript injection into rendered pages.
Patches
To fix this issue, please update to version 0.7.0 or later.
Workarounds
There are no known workarounds for this issue. Please update to version 0.7.0
Other sources
apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@apollo/experimental-nextjs-app-supportto a version that resolves this vulnerability.Fixed in 0.7.0 - Upgrade
Upgrade
@apollo/experimental-apollo-client-nextjsto a version that resolves this vulnerability.Fixed in 0.7.0 - Upgrade
Upgrade
apollo-client-nextjsto a version that resolves this vulnerability.Fixed in 0.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23841?
CVE-2024-23841 is classified as a cross-site scripting vulnerability that poses a significant security risk.
How do I fix CVE-2024-23841?
To remediate CVE-2024-23841, upgrade the @apollo/experimental-nextjs-app-support package to version 0.7.0 or higher.
Which packages are affected by CVE-2024-23841?
CVE-2024-23841 affects the @apollo/experimental-nextjs-app-support package up to version 0.6.0 and the Apollo Client package below version 0.7.0.
What type of vulnerability is CVE-2024-23841?
CVE-2024-23841 is a cross-site scripting (XSS) vulnerability that can allow an attacker to inject malicious scripts.
What are the potential impacts of CVE-2024-23841?
The potential impact of CVE-2024-23841 includes unauthorized data access and user session hijacking due to improper handling of untrusted input.