How severe is GHSA-r9q4-w3fm-wrm2?

No CVSS score has been assigned to GHSA-r9q4-w3fm-wrm2 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-r9q4-w3fm-wrm2?

GHSA-r9q4-w3fm-wrm2 affects the following packages: google-closure-library (npm). Ecosystems affected: npm.

How do I fix GHSA-r9q4-w3fm-wrm2?

Update google-closure-library to 20190301.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r9q4-w3fm-wrm2 is resolved across your whole dependency graph.

How do I detect GHSA-r9q4-w3fm-wrm2 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for google-closure-library, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-r9q4-w3fm-wrm2 if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is GHSA-r9q4-w3fm-wrm2 actively exploited in the wild?

No public exploit code has been indexed for GHSA-r9q4-w3fm-wrm2 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-r9q4-w3fm-wrm2 published, and has it been updated?

GHSA-r9q4-w3fm-wrm2 was published on September 2, 2020 and was last updated on September 27, 2021. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

Cross-Site Scripting in google-closure-libraryGHSA-r9q4-w3fm-wrm2

Fix: google/closure-library@c79ab48

GHSA-r9q4-w3fm-wrm2 is a security vulnerability in google-closure-library. A fix is available for google-closure-library — see the affected versions and patch details below.

Published

Sep 2, 2020

Updated

Sep 27, 2021

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Sep 27, 2021 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

📦google-closure-library

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.

Description

Versions of google-closure-library prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The safedomtreeprocessor.processToString() function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting.

Recommendation

Upgrade to version 20190301.0.0 or later.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`google-closure-library`	all versions	20190301.0.0`npm install google-closure-library@20190301.0.0`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for google-closure-library, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update google-closure-library to 20190301.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r9q4-w3fm-wrm2 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting. ## Recommendation Upgrade to version 20190301.0.0 or later.

O3 Security · Impact-Aware SCA

Is GHSA-r9q4-w3fm-wrm2 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works