CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2024-9440
Medium (6.1) in slimselectjs slim select. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in slim-select 2.9.2.
Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript. At this time, no patch is available.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- slimselectjs:slim_select
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qvqv-mcxr-x8qw | npm | slim-select | >=2.0.0 <2.9.2 | 2.9.2 |