Packages / posthog-js / Security

ModerateVulnerabilityGHSA-8775-5hwv-wr6vCVE-2023-32325Published 22 May 2023

Potential for cross-site scripting in PostHog-js

Affected releases · posthog-js

  • 1.x1.0.0 – 1.57.1Fixed in 1.57.2

On 1.x, the newest line:

npm install posthog-js@1.57.2

  1. Affected

    1.0.0 – 1.57.1

    219 releases

  2. Fixed

    1.57.2 – 1.438.13

    1202 releases, latest

1421 stable releases of posthog-js, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for posthog-js. It is read in your browser and sent nowhere.

What happens

Impact

Potential for cross-site scripting in posthog-js.

Patches

The problem has been patched in posthog-js version 1.57.2.

Workarounds

  • This isn't an issue for sites that have a Content Security Policy in place.

  • Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version.

References

We will publish details of the vulnerability in 30 days as per our security policy.