Listen to this Post
The vulnerability in Orejime arises from its processing of HTML data attributes during user consent actions. Orejime, a consent management platform, dynamically handles HTML elements related to consent purposes. Specifically, when a user consents to a tracked purpose, Orejime transforms data attributes on these elements into standard unprefixed attributes. For example, a `data-href` attribute becomes href. If an attacker can inject malicious HTML containing data attributes with `javascript:` code, such as data-href="javascript:alert('XSS')", this code is embedded. Upon consent, Orejime converts this to href="javascript:alert('XSS')", effectively executing the JavaScript within the user’s browser context. This is a form of cross-site scripting (XSS) that exploits attribute manipulation. The vulnerability stems from insufficient sanitization of attribute values during conversion. However, exploitation is constrained because Orejime typically manages hardcoded elements, and attack success requires prior HTML injection capabilities into pages using Orejime. The issue is mitigated in patched versions by validating and sanitizing attribute values before conversion.
Platform: Orejime
Version: Before version 2.3.2
Vulnerability: Executable code injection
Severity: Low
Date: 2025-12-19
Prediction: Patched in v2.3.2
What Undercode Say:
Analytics:
bash command to check version: `npm list orejime`
bash command to update: `npm update [email protected]`
code showing vulnerability: `
`
code after consent: `
`
How Exploit:
Inject HTML with malicious data attributes into Orejime-handled pages. Upon user consent, attributes convert, executing JavaScript.
Protection from this CVE:
Update to Orejime v2.3.2. Sanitize HTML attributes.
Impact:
Low impact. Requires HTML injection. Elements often hardcoded.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
