Vulnerability · Published Sep 27, 2024 · Assigned by VulDB
CVE-2024-9283RelaxedJS ReLaXed Pug to PDF Converter cross site scripting
Low 3.3
In plain English
A low-severity cross-site scripting in ReLaXed from RelaxedJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF Converter. The manipulation leads to cross site scripting. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | relaxedjs | no fix listed | GHSA-gj3p-j74v-3x57 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- VDB-278676 | RelaxedJS ReLaXed Pug to PDF Converter cross site scripting vdb-entry
- VDB-278676 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- Submit #411185 | relaxedjs - Injection third-party-advisory
- https://drive.google.com/file/d/1Ll1dRwQds8987S-l5o2iJu4MQRG-p4-A/view?usp=sharing exploit