What’s Vulnerable › Vulnerabilities

CVE-2023-41049: Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-01 · updated 2026-06-17
• Weakness: CWE-79

Description

@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.

Affected products

• decentraland single-sign-on-client: before 0.1.0 — fixed in 0.1.0

How to fix

Upgrade to a fixed version: decentraland single-sign-on-client 0.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/decentraland/single-sign-on-client/commit/bd20ea9533d0cda30809d929db85b1b76cef855a
• https://github.com/decentraland/single-sign-on-client/security/advisories/GHSA-vp4f-wxgw-7x8x
• https://github.com/decentraland/single-sign-on-client/commit/bd20ea9533d0cda30809d929db85b1b76cef855a
• https://github.com/decentraland/single-sign-on-client/security/advisories/GHSA-vp4f-wxgw-7x8x

Get alerted when CVE-2023-41049 or the next vulnerability affects your stack