mportuga eslint-detailed-reporter template-generator.js renderIssue cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The patch is identified as 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the identifier assigned to this vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mportuga | eslint-detailed-reporter | 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9 | — | No fix listed | CNA |
| — | eslint-detailed-reporter (npm) | up to 0.9.0 | — | No fix listed | GHSA-4xr4-89m5-46c7 |
- eslint-detailed-reporter Vendormportuga Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9 Fixed in — No fix listed CNA
- eslint-detailed-reporter (npm) Vendor— Affected up to 0.9.0 Fixed in — No fix listed GHSA-4xr4-89m5-46c7
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eslint-detailed-reporter_project:eslint-detailed-reporter:*:*:*:*:*:node.js:*:* | up to 0.9.0 | Vulnerable | Eslint-detailed-reporter Project |
- cpe:2.3:a:eslint-detailed-reporter_project:eslint-detailed-reporter:*:*:*:*:*:node.js:*:* Versions up to 0.9.0 Vulnerable ·Eslint-detailed-reporter Project
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4942
- 2026-10-03 Alias added: GHSA-4xr4-89m5-46c7
References
Sources
- CVE-2022-4942 · CVE Program
- CVE-2022-4942 · NVD
- FIRST EPSS
- GHSA-4xr4-89m5-46c7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences