Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
Affected releases · next
- 16.x16.0.0 – 16.2.4Fixed in 16.2.5
- 15.x15.0.0 – 15.5.15Fixed in 15.5.16
- 14.x14.0.0 – 14.2.35No fix on this line yet
- 13.x13.0.0 – 13.5.11No fix on this line yet
On 16.x, the newest line:
npm install next@16.2.5Affected
16.0.0 – 16.2.4
25 releases
Fixed
16.2.5 – 16.4.2
20 releases, latest
Affected
15.0.0 – 15.5.15
70 releases
Fixed
15.5.16 – 15.5.28
12 releases
Affected
14.0.0 – 14.2.35
46 releases
Affected
13.0.0 – 13.5.11
56 releases
Is your project affected?
Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.
What happens
Impact
Applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser.
Fix
We now HTML-escape serialized beforeInteractive script content before embedding it into the page, preventing attacker-controlled content from breaking out of the inline script boundary.
Workarounds
If you cannot upgrade immediately, do not pass untrusted data into beforeInteractive scripts. If that pattern is unavoidable, sanitize or escape the content before embedding it.