CVE-2020-7741

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	hellojs	>= unspecified, < 1.18.6

References

https://github.com/MrSwitch/hello.js/blob/3b79ec93781b3d7b9c0b56f598e060301d1f3e73/dist/hello.all.js%23L1545Broken Link
https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546Third Party Advisory
https://github.com/MrSwitch/hello.js/blob/3b79ec93781b3d7b9c0b56f598e060301d1f3e73/dist/hello.all.js%23L1545Broken Link
https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546Third Party Advisory

Timeline

Published: Oct 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77427.5This affects the package simpl-schema before 1.10.2.CVE-2020-77437.3The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.CVE-2020-77444.7This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality CVE-2020-77457.1This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a b CVE-2020-77469.8This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are p CVE-2020-77476.3This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.CVE-2020-77488.1This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils CVE-2020-77497.6This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{CVE-2020-77509.6This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, CVE-2020-77517.2pathval before version 1.1.1 is vulnerable to prototype pollution.CVE-2020-77528.8This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate cur CVE-2020-77537.5All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().