Description
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a datatables.net
unspecified to < 1.11.3affected
References
- https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544 ↗
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371 ↗
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376 ↗
- https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b ↗
- https://cdn.datatables.net/1.11.3/ ↗
- https://lists.debian.org/debian-lts-announce/2023/08/msg00018.html ↗
- https://security.netapp.com/advisory/ntap-20240621-0006/ ↗