CVE-2024-9440

Summary

CVE-2024-9440 is a newly disclosed cross-site scripting (XSS) vulnerability affecting Slim Select 2.0 versions up to 2.9.0. The issue lies in the 'createOption()' function in the select.ts file, where user-supplied data from the 'Options' object is directly assigned to the innerHTML property without proper sanitation. This lack of input validation creates an opportunity for attackers to inject malicious scripts, potentially leading to unintended execution of code. User interfaces that dynamically generate lists using unsanitized user input are at risk, making it essential to apply a patch as soon as one becomes available.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.