Vulnerabilities in pkg:npm/jquery.terminal

PACKAGE
Advisory Identifier: GHSA-x9r5-jxvq-4387
Share
Advisory Summary

CVE-2021-43862 is a LOW (CVSS 3.7) cross-site scripting vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)) affecting Jquery.terminal libraries in the npm ecosystem. The issue involves jquery.terminal self xss on user input. Remediation is available by upgrading affected packages to version 2.31.1.

2 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:npm/jquery.terminal

2 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:npm/jquery.terminal. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-x9r5-jxvq-4387 CVE-2021-43862 LOW jquery.terminal self XSS on user input
GHSA-2hwp-g4g7-mwwj - MODERATE Reflected Cross-Site Scripting in jquery.terminal

CVE-2021-43862 at a Glance

CVE Identifier CVE-2021-43862
GHSA Identifier GHSA-x9r5-jxvq-4387
Severity LOW
CVSS v3.1 Base Score 3.7
CWE Classification CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Product Jquery.terminal
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 3.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2021-43862

To remediate this vulnerability, upgrade all affected Jquery.terminal dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

jquery.terminal fixed: 2.31.1 
npm install jquery.terminal@2.31.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls jquery.terminal

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2021-43862, inspect your project dependencies using npm:

npm ls jquery.terminal

Analyze the terminal output to locate any version of Jquery.terminal in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.31.1), your application is affected.

Note: The npm ls jquery.terminal command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. In Jquery.terminal, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees. Also if the application use execHash option and execute code from URL the attacker can use this URL to execute his code. The scope is limited because the javascript code inside html attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible. ### Patches Fixed version 2.31.1 ### Workarounds The user can use formatting that wrap whole user input and it's no op. ```javascript $.terminal.new_formatter([/([\s\S]+)/g, '[[;;]$1]']); ``` The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way). ### References The issue was reported here [jcubic/jquery.terminal#727](https://github.com/jcubic/jquery.terminal/issues/727) ### For more information If you have any questions or comments about this advisory: * Open an issue in [jcubic/jquery.terminal](https://github.com/jcubic/jquery.terminal) * Email us at [jcubic@onet.pl](mailto:jcubic@onet.pl)

CVE-2021-43862 Affected Jquery.terminal Versions

1 component(s)
Fixed Versions:
2.31.1
Product / Package Ecosystem Affected Versions Fixed Version
jquery.terminal
npm/jquery.terminal
npm
< 2.31.1
2.31.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/jcubic/jquery.terminal/security/advisories/GHSA-x9r5-jxvq-4387
NVD — CVE-2021-43862 NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43862
Jquery.terminal Source Repository REPOSITORY
https://github.com/jcubic/jquery.terminal/issues/727
Security Fix Commit FIX COMMIT
https://github.com/jcubic/jquery.terminal/commit/77eb044d0896e990d48a9157f0bc6648f81a84b5
Jquery.terminal Source Repository REPOSITORY
https://github.com/jcubic/jquery.terminal
Jquery.terminal Release RELEASE
https://github.com/jcubic/jquery.terminal/releases/tag/2.31.1

Frequently Asked Questions

What is CVE-2021-43862?
CVE-2021-43862 is a security vulnerability in Jquery.terminal involving jquery.terminal self XSS on user input under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).
Which Jquery.terminal versions are affected?
Affected versions include releases prior to 2.31.1 across affected packages: jquery.terminal.
What version fixes CVE-2021-43862?
Upgrading to 2.31.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is jquery.terminal affected?
Yes, jquery.terminal is affected in releases prior to 2.31.1. Upgrade your dependency to 2.31.1 or later.
What is the CVSS score of CVE-2021-43862?
CVE-2021-43862 has a CVSS v3.1 base score of 3.7 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N.
What CWE is associated with CVE-2021-43862?
CVE-2021-43862 is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.).
How can I check npm dependencies for CVE-2021-43862?
Run the dependency tree command: 'npm ls jquery.terminal'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x9r5-jxvq-4387",
  "modified" : "2022-08-11T19:20:18Z",
  "published" : "2022-01-06T22:48:56Z",
  "aliases" : [ "CVE-2021-43862" ],
  "summary" : "jquery.terminal self XSS on user input",
  "details" : "### Impact\nThis is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees.\n\nAlso if the application use execHash option and execute code from URL the attacker can use this URL to execute his code. The scope is limited because the javascript code inside html attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible.\n\n### Patches\nFixed version 2.31.1\n\n### Workarounds\nThe user can use formatting that wrap whole user input and it's no op.\n\n```javascript\n$.terminal.new_formatter([/([\\s\\S]+)/g, '[[;;]$1]']);\n```\nThe fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way).\n\n### References\nThe issue was reported here [jcubic/jquery.terminal#727](https://github.com/jcubic/jquery.terminal/issues/727)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [jcubic/jquery.terminal](https://github.com/jcubic/jquery.terminal)\n* Email us at [jcubic@onet.pl](mailto:jcubic@onet.pl)\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "jquery.terminal"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.31.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jcubic/jquery.terminal/security/advisories/GHSA-x9r5-jxvq-4387"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-43862"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jcubic/jquery.terminal/issues/727"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jcubic/jquery.terminal/commit/77eb044d0896e990d48a9157f0bc6648f81a84b5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jcubic/jquery.terminal"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jcubic/jquery.terminal/releases/tag/2.31.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79", "CWE-80" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-01-06T19:18:42Z",
    "nvd_published_at" : "2021-12-30T15:15:00Z"
  }
}