CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2018-19289
Medium (6.1) in valine.js valine. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in valine 1.3.4.
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- valine.js:valine
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hhrp-qm88-xjr3 | npm | valine | <1.3.4 | 1.3.4 |