Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

htmr versions prior to 0.8.7 allow malicious code to run in browsers

published 6 years ago
Summary

Using older versions of the htmr package could allow a hacker to trick a user's browser into running malicious code. This could happen if a user visits a website that uses htmr and the hacker has inserted malicious code into the website. To fix this, update to the latest version of htmr, which is 0.8.7 or later.

What to do
  • Update pveyes htmr to version 0.8.7.
Affected software
Ecosystem VendorProductAffected versions
npm pveyes htmr < 0.8.7
Fix: upgrade to 0.8.7
Original advisory text
Cross-Site Scripting in htmr
Versions of `htmr` prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS). The package uses `innerHTML` to unescape HTML entities. This may lead to [DOM-based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS) through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.8.7 or later.
References
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Sep 2020
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-f8rq-m28h-8hxj · GHSA
Track software like this
Free during beta