CVE-2022-25854

MEDIUM

@yaireo/tagify < 4.9.8 - Stored Cross-Site Scripting via Placeholder Value

Title source: llm
STIX 2.1

Description

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.

References (5)

Core 5
Core References
Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/yairEO/tagify/issues/988
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/yairEO/tagify/releases/tag/v4.9.8
Exploit, Patch, Third Party Advisory x_refsource_misc
https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/

Scores

CVSS v3 5.4
EPSS 0.0095
EPSS Percentile 57.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
tagify_project/tagify < 4.9.8
yaireo/tagify 0 - 4.9.8npm
Published Apr 29, 2022
Tracked Since Feb 18, 2026