` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.\n\n\n## Recommendation\n\nUpgrade to version 1.9.2","image":"https://o3.security/opengraph.png","datePublished":"2020-09-01T21:25:46Z","dateModified":"2020-08-31T18:34:28Z","url":"https://o3.security/vulnerability/GHSA-mpjf-8cmf-p789","inLanguage":"en","author":{"@id":"https://o3.security/#organization"},"publisher":{"@id":"https://o3.security/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://o3.security/vulnerability/GHSA-mpjf-8cmf-p789"},"speakable":{"@type":"SpeakableSpecification","cssSelector":["h1",".vuln-summary",".vuln-severity",".vuln-mitigation"]},"about":[{"@type":"SoftwareApplication","name":"jingo","applicationCategory":"npm","softwareVersion":"1.9.2"}],"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-mpjf-8cmf-p789"},{"@type":"CreativeWork","url":"https://www.npmjs.com/advisories/750"}]}` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.\n\n\n## Recommendation\n\nUpgrade to version 1.9.2","url":"https://o3.security/vulnerability/GHSA-mpjf-8cmf-p789","identifier":"GHSA-mpjf-8cmf-p789","datePublished":"2020-09-01T21:25:46Z","dateModified":"2020-08-31T18:34:28Z","inLanguage":"en","license":"https://creativecommons.org/licenses/by/4.0/","keywords":["GHSA-mpjf-8cmf-p789","CVE","vulnerability","security advisory"],"creator":{"@id":"https://o3.security/#organization"},"isAccessibleForFree":true,"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-mpjf-8cmf-p789"}]}` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.\n\n\n## Recommendation\n\nUpgrade to version 1.9.2"}},{"@type":"Question","name":"How severe is GHSA-mpjf-8cmf-p789?","acceptedAnswer":{"@type":"Answer","text":"No CVSS score has been assigned to GHSA-mpjf-8cmf-p789 yet. Review the advisory details and affected package list to assess your exposure."}},{"@type":"Question","name":"Which packages are affected by GHSA-mpjf-8cmf-p789?","acceptedAnswer":{"@type":"Answer","text":"GHSA-mpjf-8cmf-p789 affects the following packages: jingo (npm). Ecosystems affected: npm."}},{"@type":"Question","name":"How do I fix GHSA-mpjf-8cmf-p789?","acceptedAnswer":{"@type":"Answer","text":"Update jingo to 1.9.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mpjf-8cmf-p789 is resolved across your whole dependency graph."}},{"@type":"Question","name":"How do I detect GHSA-mpjf-8cmf-p789 in my npm dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for jingo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version."}},{"@type":"Question","name":"How do I mitigate GHSA-mpjf-8cmf-p789 if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page."}},{"@type":"Question","name":"Is GHSA-mpjf-8cmf-p789 actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for GHSA-mpjf-8cmf-p789 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"When was GHSA-mpjf-8cmf-p789 published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"GHSA-mpjf-8cmf-p789 was published on September 1, 2020 and was last updated on August 31, 2020. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}
Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

Cross-Site Scripting in jingoGHSA-mpjf-8cmf-p789

GHSA-mpjf-8cmf-p789 is a security vulnerability in jingo. A fix is available for jingo — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Aug 31, 2020 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
jingonpm
217downloads / week

Description

Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.

Recommendation

Upgrade to version 1.9.2

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmjingoall versions1.9.2npm install jingo@1.9.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for jingo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update jingo to 1.9.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mpjf-8cmf-p789 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

Versions of `jingo` prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as `<script>alert(1)</script>` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text. ## Recommendation Upgrade to version 1.9.2
O3 Security · Impact-Aware SCA

Is GHSA-mpjf-8cmf-p789 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Cross-Site Scripting in jingo