CVE-2020-7749

Katalog CVE

CVSS 7.6 · High EPSS 1,6%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada osm-static-maps project osm-static-maps. Skor CVSS 3.1 7.6 (High) menurut snyk.io.

Deskripsi (NVD)

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.

Rincian

Terbit di NVD

20 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.6 (High), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jperelli/osm-static-maps/pull/24 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-OSMSTATICMAPS-609637 exploit · advisory pihak ketiga
• https://github.com/jperelli/osm-static-maps/blob/master/src/template.html%23L142 broken link