Description
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 14 | | =1:7.0.10+dfsg-2 || =1:7.0.22+dfsg-1 || =1:7.0.22+dfsg-1.1 || =1:7.0.22+dfsg-1~bpo13+1 || =1:7.0.22+dfsg-1~deb13u1 || >=0 <1:7.0.27+dfsg-1 | 1:7.0.27+dfsg-1 |
debian 12 | | =1:6.0.14+dfsg-1 || =1:6.0.23+dfsg-1 || =1:6.0.23+dfsg-1~bpo12+1 || =1:6.0.24+dfsg-1 || =1:6.0.25+dfsg-1 || =1:6.0.29+dfsg-1 || =1:7.0.0+dfsg-1 || =1:7.0.0+dfsg-2 || =1:7.0.0+dfsg-2~bpo12+1 || =1:7.0.1+dfsg-1 || =1:7.0.1+dfsg-1~bpo12+1 || =1:7.0.10+dfsg-1 || =1:7.0.10+dfsg-2 || =1:7.0.2+dfsg-1 || =1:7.0.2+dfsg-1~bpo12+1 || =1:7.0.22+dfsg-1 || =1:7.0.22+dfsg-1.1 || =1:7.0.22+dfsg-1~bpo13+1 || =1:7.0.22+dfsg-1~deb13u1 || =1:7.0.27+dfsg-1 || =1:7.0.29+dfsg-1 || =1:7.0.29+dfsg-2 || =1:7.0.29+dfsg-2~bpo13+1 || =1:7.0.3+dfsg-1 || =1:7.0.5+dfsg-1 || =1:7.0.5+dfsg-1~bpo12+1 || =1:7.0.6+dfsg-1 || =1:7.0.9+dfsg-1 || =1:7.0.9+dfsg-1~bpo12+1 | - |
debian 13 | | =1:7.0.10+dfsg-2 || =1:7.0.22+dfsg-1 || =1:7.0.22+dfsg-1.1 || =1:7.0.22+dfsg-1~bpo13+1 || =1:7.0.22+dfsg-1~deb13u1 || =1:7.0.27+dfsg-1 || =1:7.0.29+dfsg-1 || =1:7.0.29+dfsg-2 || =1:7.0.29+dfsg-2~bpo13+1 | - |
