{"id":"GHSA-pg97-ww7h-5mjr","summary":"XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode ","details":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nPotential XSS vulnerability for users of `dojox/xmpp` and `dojox/dtl`.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of these versions of Dojo:\n\n* 1.16.1\n* 1.15.2\n* 1.14.5\n* 1.13.6\n* 1.12.7\n* 1.11.9\n\nUsers of Dojo 1.10.x and earlier should review this change and determine if it impacts them, and backport the change as appropriate.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe change applied in https://github.com/dojo/dojox/pull/315 could get added separately as a patch.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [dojo/dojox](https://github.com/dojo/dojox/)","aliases":["CVE-2019-10785","SNYK-JS-DOJOX-548257,"],"modified":"2026-05-07T05:00:45.778507629Z","published":"2020-02-13T22:21:06Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2020-02-13T22:20:36Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/dojo/dojox/security/advisories/GHSA-pg97-ww7h-5mjr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10785"},{"type":"WEB","url":"https://github.com/dojo/dojox/pull/315"},{"type":"WEB","url":"https://github.com/dojo/dojox/commit/abd033a787c718abc1a390f480ac3ea61288e5ee"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/02/msg00033.html"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-DOJOX-548257"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-DOJOX-548257,"}],"affected":[{"package":{"name":"dojox","ecosystem":"npm","purl":"pkg:npm/dojox"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-pg97-ww7h-5mjr/GHSA-pg97-ww7h-5mjr.json"}},{"package":{"name":"dojox","ecosystem":"npm","purl":"pkg:npm/dojox"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.12.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-pg97-ww7h-5mjr/GHSA-pg97-ww7h-5mjr.json"}},{"package":{"name":"dojox","ecosystem":"npm","purl":"pkg:npm/dojox"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-pg97-ww7h-5mjr/GHSA-pg97-ww7h-5mjr.json"}},{"package":{"name":"dojox","ecosystem":"npm","purl":"pkg:npm/dojox"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-pg97-ww7h-5mjr/GHSA-pg97-ww7h-5mjr.json"}},{"package":{"name":"dojox","ecosystem":"npm","purl":"pkg:npm/dojox"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-pg97-ww7h-5mjr/GHSA-pg97-ww7h-5mjr.json"}},{"package":{"name":"dojox","ecosystem":"npm","purl":"pkg:npm/dojox"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.1"}]}],"versions":["1.16.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/02/GHSA-pg97-ww7h-5mjr/GHSA-pg97-ww7h-5mjr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}