CVE-2017-16043

Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.

Score

CVSS 3.1 6.1 Medium

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-16

Weaknesses

CWE-74, CWE-80

Affected products

• Shout Node Module (Hackerone)
• Shout (Shout Project)

References

• https://github.com/erming/shout/pull/344
• https://nodesecurity.io/advisories/322