https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 05:43:52 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-03063 bdu:2022-03063 https://cve.radiocsirt.org/vuln/bdu:2022-03063 https://cve.radiocsirt.org/vuln/euvd-2026-234178 EUVD-2026-234178 https://cve.radiocsirt.org/vuln/euvd-2026-234178 https://cve.radiocsirt.org/vuln/fkie_cve-2022-29172 <p>Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient&#39;s name within the delivered email template. You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields” feature in your application. Upgrade to version `11.33.0`.</p> <p>Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient&#39;s name within the delivered email template. You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields” feature in your application. Upgrade to version `11.33.0`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-29172 https://cve.radiocsirt.org/vuln/ghsa-7ww6-75fj-jcj7 <p><strong>Affected:</strong> npm: auth0-lock</p> <p>### Overview</p> <p>In versions before and including `11.32.2`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property).</p> <p>Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient&#39;s name within the delivered email template.</p> <p>### Am I affected? You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields” feature in your application.</p> <p>### How to fix that? Upgrade to version `11.33.0`.</p> <p>### Will this update impact my users? Additional signup fields that have been added to the signup tab on Lock will have HTML tags stripped from user input from version `11.33.0` onwards. The user will not receive any validation warning or feedback, but backend data will no longer include HTML.</p> <p><strong>Affected:</strong> npm: auth0-lock</p> <p>### Overview</p> <p>In versions before and including `11.32.2`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property).</p> <p>Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient&#39;s name within the delivered email template.</p> <p>### Am I affected? You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields” feature in your application.</p> <p>### How to fix that? Upgrade to version `11.33.0`.</p> <p>### Will this update impact my users? Additional signup fields that have been added to the signup tab on Lock will have HTML tags stripped from user input from version `11.33.0` onwards. The user will not receive any validation warning or feedback, but backend data will no longer include HTML.</p> https://cve.radiocsirt.org/vuln/ghsa-7ww6-75fj-jcj7 https://cve.radiocsirt.org/vuln/gsd-2022-29172 gsd-2022-29172 https://cve.radiocsirt.org/vuln/gsd-2022-29172