Threats tagged 'ghsa-24x7-7wwm-wff3'

Zipline versions from 4.3.0 up to but not including 4.5.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated low-privilege users to inject malicious HTML and JavaScript via unescaped embed settings in server-side rendered meta tags. Specifically, attackers can manipulate embedTitle, embedDescription, embedSiteName, or embedColor values through the PATCH /api/user endpoint. When other users visit the affected file view pages, the injected script executes in their browsers.