TI-2020-17283 Aliases CVE-2020-28470 GHSA-r96p-v3cr-gfv8

Cross-site scripting (XSS) in @scullyio/scully

LOW 34CWE-79Published 2021-01-14 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.

Why it matters now

EPSS 0.00835 57th percentileScored 2026-11-07

Fix Fixed @scullyio/scully: 1.0.9@scullyio/scully (npm): 1.0.9+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	@scullyio/scully	before 1.0.9	1.0.9	Patch available	CNA
—	@scullyio/scully (npm)	before 1.0.9	1.0.9	Patch available	GHSA-r96p-v3cr-gfv8
—	@scullyio/ng-lib (npm)	before 1.0.1	1.0.1	Patch available	GHSA-r96p-v3cr-gfv8

@scullyio/scully Vendor— Affected before 1.0.9 Fixed in 1.0.9 Patch available CNA
@scullyio/scully (npm) Vendor— Affected before 1.0.9 Fixed in 1.0.9 Patch available GHSA-r96p-v3cr-gfv8
@scullyio/ng-lib (npm) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-r96p-v3cr-gfv8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:scully:scully::::::::	before 1.0.9	Vulnerable	Scully

cpe:2.3:a:scully:scully:*:*:*:*:*:*:*:* Versions before 1.0.9 Vulnerable ·Scully

Remediation

Fix · CNA @scullyio/scully Fixed in 1.0.9
Fix · GHSA-r96p-v3cr-gfv8 @scullyio/scully (npm) Fixed in 1.0.9 Advisory →
Fix · GHSA-r96p-v3cr-gfv8 @scullyio/ng-lib (npm) Fixed in 1.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-28470
2026-10-03 Alias added: GHSA-r96p-v3cr-gfv8

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences