What’s Vulnerable › Vulnerabilities

CVE-2017-16015

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-04 · updated 2026-06-17
• Weakness: CWE-80

Description

Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting

Affected products

• HackerOne forms node module: before 1.3.0 — fixed in 1.3.0

How to fix

Upgrade to a fixed version: HackerOne forms node module 1.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/caolan/forms/commit/bc01e534a0ff863dedb2026a50bd03153bbc6a5d
• https://nodesecurity.io/advisories/158
• https://github.com/caolan/forms/commit/bc01e534a0ff863dedb2026a50bd03153bbc6a5d
• https://nodesecurity.io/advisories/158

Get alerted when CVE-2017-16015 or the next vulnerability affects your stack