CVE-2021-32641

Name of the Vulnerable Software and Affected Versions auth0-lock versions 11.30.0 and earlier

Description The issue concerns a reflected XSS attack. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage, or the library's languageDictionary feature is utilized and user input or data from URL parameters is incorporated into the languageDictionary.

Recommendations For versions 11.30.0 and earlier, upgrade to version 11.30.1 to resolve the issue. As a temporary workaround, consider disabling the flashMessage and languageDictionary features until a patch is available. Restrict access to user input or data from URL parameters in these features to minimize the risk of exploitation.