5.4
Medium
CVE-2021-23784 This affects the package tempura before 0.4.0
Description
This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| tempura 0.4 | earliest → < 0.4.0 | 0.4.0 |