CVE-2022-29230

Name of the Vulnerable Software and Affected Versions Hydrogen versions 0.10.0 through 0.18.0

Description There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This vulnerability is exploitable in applications whose hydrating data is user controlled. The Content Security Policy is not an effective mitigation for this vulnerability.

Recommendations For Hydrogen versions 0.10.0 through 0.18.0, upgrade the project to version 0.19.0 as soon as possible, as there is no current workaround for this issue.