Cross-site Scripting in @spscommerce/ds-react
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
### Impact XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS. ### Patches The code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher ### Workarounds This is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended. ### References https://github.com/SPSCommerce/woodland/blob/c49e999f97f3c0b56502859f4de1e8c6666dd74d/packages/ds-react/src/option-list/SpsOptionList.tsx#L559
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | @spscommerce/ds-react (npm) | 4.12.2 to before 7.17.4 | 7.17.4 | Patch available | GHSA-cfxh-frx4-9gjg |
- @spscommerce/ds-react (npm) Vendor— Affected 4.12.2 to before 7.17.4 Fixed in 7.17.4 Patch available GHSA-cfxh-frx4-9gjg
Remediation
- Fix · GHSA-cfxh-frx4-9gjg @spscommerce/ds-react (npm) Fixed in 7.17.4 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-cfxh-frx4-9gjg
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences