CVE-2022-23068

Name of the Vulnerable Software and Affected Versions ToolJet versions v0.6.0 to v1.10.2

Description The issue allows an attacker to inject malicious code inside the first name and last name fields while inviting a new user, which will be reflected in the invitational e-mail. This is an HTML injection issue.

Recommendations For ToolJet versions v0.6.0 to v1.10.2, consider restricting the input for the first name and last name fields to prevent HTML injection until a patch is available. As a temporary workaround, validate and sanitize user input in these fields to minimize the risk of exploitation.