CVE-2023-41049

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-41054.3Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and downloa CVE-2023-410507.7AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format s CVE-2023-410514.7In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers CVE-2023-410525.3Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256 CVE-2023-410533.3Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant CVE-2023-410549.1LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side R CVE-2023-410557.5LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side R CVE-2023-410568.1Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overf CVE-2023-410575.5hyper-bump-it is a command line tool for updating the version in project files.`hyper-bump-it` reads a file glob pattern from the configurat CVE-2023-410587.5Parse Server is an open source backend server. In affected versions the Parse Cloud trigger `beforeFind` is not invoked in certain condition CVE-2023-41066.5Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being CVE-2023-410608.8A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. A remote user may b