JavaScript execution via malicious molfiles (XSS)

GHSA-2pwh-52h7-7j84 · CVE-2024-0758

Published Apr 16, 2021 · Modified Jul 8, 2026

Description

Impact

The viewer plugin implementation of <mol:molecule> renders molfile data directly inside a <script> tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.

Patches

Patched in v0.3.0: Molfile data is now rendered as value of a hidden <input> tag and escaped via JSF's mechanisms.

Workarounds

No workaround available.

References

WEB https://github.com/ipb-halle/MolecularFaces/security/advisories/GHSA-2pwh-52h7-7j84
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-0758
PACKAGE https://github.com/ipb-halle/MolecularFaces
WEB https://vulncheck.com/advisories/vc-advisory-GHSA-2pwh-52h7-7j84

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes