Cross-Site Scripting in bracket-template
Priority LOW 38CWE-79Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- No fix listed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template. ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Why it matters now
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | bracket-template (npm) | up to 1.1.5 | — | No fix listed | GHSA-jj6g-7j8p-7gf2 |
- bracket-template (npm) Vendor— Affected up to 1.1.5 Fixed in — No fix listed GHSA-jj6g-7j8p-7gf2
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-03 Threatist record created from GHSA-jj6g-7j8p-7gf2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences