@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability
Date: 2024-01
Affected: npm/@apollo/experimental-nextjs-app-support
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-23841
CWE: CWE-80
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)

### Impact The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this vulnerability, we implemented appropriate escaping to prevent javascript injection into rendered pages. ### Patches To fix this issue, please update to version 0.7.0 or later. ### Workarounds There are no known workarounds for this issue. Please update to version 0.7.0


Mitigations:

Architectural layers (MAESTRO):