← Back

Hello.js Project

hello.js_project

2 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Hello.js
hello.js
2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-26505
1Hello.js Project
1Hello.js
Jun 17, 2026
Aug 11, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.
CVE-2020-7741
1Hello.js Project
1Hello.js
Jun 17, 2026
Oct 6, 2020
N/A· v4
9.9 CRITICAL· v3
7.5 HIGH· v2
This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param...Show more
This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).Show less