Most recent entries from all

EUVD-2026-164015

fkie_cve-2010-2273

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to dojo/resources/iframe_history.html, dojox/av/FLAudio.js, dojox/av/FLVideo.js, dojox/av/resources/audio.swf, dojox/av/resources/video.swf, util/buildscripts/jslib/build.js, and util/buildscripts/jslib/buildUtil.js, as demonstrated by the (1) dojoUrl and (2) testUrl parameters to util/doh/runner.html.

GHSA-536q-8gxx-m782 — Cross-Site Scripting in dojo

Affected: npm: dojo

Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.

## Recommendation

Upgrade to version 1.4.2 or later.

Most recent entries from all

EUVD-2026-164015

fkie_cve-2010-2273

GHSA-536q-8gxx-m782 — Cross-Site Scripting in dojo

gsd-2010-2273