Most recent entries from all

EUVD-2026-190377

2026-10-28T20:03:50.138540+00:00

EUVD-2026-190377

fkie_cve-2023-41049

2026-10-28T20:03:50.138588+00:00

@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.

GHSA-vp4f-wxgw-7x8x — Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client

2026-10-28T20:03:50.138619+00:00

Affected: npm: @dcl/single-sign-on-client

### Impact Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix

```ts SSO.init('javascript:alert("javascript successfully injected")') ```

### Patches

This vulnerability was patched on version `0.1.0`

### Workarounds

This vulnerability can be prevented if user input correctly sanitized or there is no user input pass to the `init` function

gsd-2023-41049

2026-10-28T20:03:50.138659+00:00

gsd-2023-41049