5.4
Medium
CVE-2022-25854 This affects the package @yaireo/tagify before 4.9.8
Description
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| @yaireo/tagify 4.9 | earliest → < 4.9.8 | 4.9.8 |