auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.

Affected: npm: auth0-lock

### Overview

Versions before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's - `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage`. - `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`.

### Am I affected? You are affected by this vulnerability if you are using `auth0-lock` version `11.30.0` or lower and all of the following conditions apply:

- You are utilizing `flashMessage` feature. - User input or data from URL parameters is incorporated into the `flashMessage`.

An example of a vulnerable snippet where query parameters are used to populate the `text` property of a `flashMessage`. ```js var params = new URLSearchParams(location.search); var errorMessage = params.get('error__message'); var showParams = {};

if (!!errorMessage === true) { showParams.flashMessage = { type: 'error', text: 'We were unable to log you in. ' + errorMessage, }; }

lock.show(showParams); ```

OR

- You are utilizing `languageDictionary` feature. - User input or data from URL parameters is used in `languageDictionary` properties.

An example of a vulnerable snippet where query parameters are used to populate the `socialLoginInstructions` property of a `languageDictionary`. ```js var params = new URLSearchParams(location.search); var instruction = params.get('instruction');

v…