Threats affecting pkg:github/nuwcdivnpt/stig-manager

STIG Manager versions 1.5.10 through 1.6.7 contain a reflected Cross-Site Scripting (XSS) vulnerability in the OIDC authentication error handling code. The vulnerability arises because the 'error' and 'error_description' query parameters are inserted into the DOM without proper HTML escaping, allowing execution of arbitrary JavaScript. This is particularly dangerous if the user has an active STIG Manager session in another tab, as the injected script can interact with the SharedWorker managing authentication tokens, enabling unauthorized API requests. The issue is fixed in version 1.6.8.