Improper Neutralization of Input During Web Page Generation in Select2

Also known as GHSA-rf66-hmqf-q3fc

Published 7 y ago 2019-03-27 · modified 58 d ago 2026-09-10 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.8%

percentile 78%

Public exploits

none known

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.

Exploit prediction (EPSS)

1.76% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`select2`	<4.0.6	4.0.6

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /snipe/snipe-it/pull/6831 · x_refsource_MISC, x_transferred
github.com /select2/select2/issues/4587 · x_refsource_MISC, x_transferred
github.com /snipe/snipe-it/pull/6831/commits/5848d9a10c7d62c73ff6a3858edfae96a429402a · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-10744 · advisory
github.com /select2/select2 · package

Sources

CVE List: CVE-2016-10744
GitHub Advisory: GHSA-rf66-hmqf-q3fc
NVD: CVE-2016-10744

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.