前端 XSS 漏洞

Description

A Cross-Site Scripting (XSS) vulnerability has been found in Sea.js due to improper handling of user input in certain frontend code. The code uses innerHTML to insert user input directly into the DOM without proper sanitization. This could allow attackers to inject malicious JavaScript into the page, which would execute in the context of the user's browser.

Affected Version

Sea.js vX.X.X (and possibly earlier versions)

Steps to Reproduce

1. The vulnerability occurs when unsanitized user input is inserted into the DOM using innerHTML.
2. An attacker can craft a payload and inject malicious JavaScript that will execute in the user's browser.

Impact

This vulnerability allows attackers to execute arbitrary scripts in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious actions.

Suggested Fix

• Replace innerHTML with textContent or other methods that do not interpret HTML.
• Apply proper input sanitization and escaping to prevent malicious code execution.