Read the docs
TI-2024-24693 Aliases CVE-2024-37166GHSA-vvhj-v88f-5gxr

ghtml Cross-Site Scripting (XSS) vulnerability

Priority MEDIUM 41CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protection against all types of XSS attacks in every scenario. This aligns with the approach taken by other template engines. Developers should be cautious and take additional measures to sanitize user input and prevent potential vulnerabilities. Additionally, the backtick character (`) is now also escaped to prevent the creation of strings in most cases where a malicious actor somehow gains the ability to write JavaScript. This does not provide comprehensive protection either.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Fixed ghtml (gurgunday): 2.0.0ghtml (npm): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gurgundayghtmlbefore 2.0.02.0.0Patch availableCNA
—ghtml (npm)before 2.0.02.0.0Patch availableGHSA-vvhj-v88f-5gxr
  • ghtml Vendorgurgunday Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA
  • ghtml (npm) Vendor— Affected before 2.0.0 Fixed in 2.0.0 Patch available GHSA-vvhj-v88f-5gxr

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:gurgunday:ghtml:*:*:*:*:*:*:*:*——gurgunday
  • cpe:2.3:a:gurgunday:ghtml:*:*:*:*:*:*:*:* Versions — — ·gurgunday

Remediation

  • Fix · CNA ghtml (gurgunday) Fixed in 2.0.0
  • Fix · GHSA-vvhj-v88f-5gxr ghtml (npm) Fixed in 2.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37166
  2. 2026-10-03 Alias added: GHSA-vvhj-v88f-5gxr

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences