[GHSA-j6p2-cx3w-6jcp] Cross-Site Scripting in backbone #6661
Conversation
github-actions
bot
changed the base branch from
main
to
ljharb/advisory-improvement-6661
|
Hi @ljharb, your findings are consistent with jashkenas/backbone@7ae0384, the commit that introduces |
advisory-database
bot
merged commit f26d986
into
ljharb/advisory-improvement-6661
|
Hi @ljharb! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
There was a problem hiding this comment.
Pull request overview
This PR updates a GitHub Security Advisory (GHSA) for a Cross-Site Scripting vulnerability in the backbone npm package. The update corrects the version range information for affected products, clarifying that the vulnerability specifically affects version 0.3.3, not all versions from 0 onwards.
Changes:
- Modified the "introduced" version from "0" to "0.3.3" to reflect that earlier versions (0.3.0-0.3.2) did not have the vulnerable escapeHTML functionality
- Added an explicit "versions" array listing the specific affected version (0.3.3)
- Updated the "modified" timestamp to reflect the advisory change
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Updates
Comments