Vulnerability · Published Jul 6, 2021 · Assigned by mitre
CVE-2021-35440
Medium 6.1
In plain English
A medium-severity security flaw in the smashing package (RubyGems). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL's for deploying, or cookies that are very permissive) private information may be retrieved by the attacker.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | smashing | 1.3.5 | GHSA-254j-mmc5-qhpx |