Description
Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
guardian language-system
Default version status: affected
0 to ≤ e42c395ec4b03fe62973a669c9209a673838b8a4affected
pkg:github/guardian/language-system