CVE-2018-16481
Description
Cross-site scripting (XSS) vulnerability in html-page library <=2.1.1 allows execution of arbitrary JavaScript via unsanitized file paths.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Cross-site scripting (XSS) vulnerability in html-page library <=2.1.1 allows execution of arbitrary JavaScript via unsanitized file paths.
## Vulnerability html-page versions <=2.1.1 contain a stored XSS vulnerability. The library fails to sanitize file paths before rendering them in the browser, allowing injection of arbitrary JavaScript code. The issue is present in all versions up to and including 2.1.1.
Exploitation
An attacker can craft a malicious URL or file path containing JavaScript code. When a user uses the vulnerable library to render an HTML page with such a path, the script executes in the user's browser. No authentication is required, as it relies on user interaction (rendering the page).
Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to theft of cookies, session tokens, or other sensitive information, or perform actions on behalf of the user.
Mitigation
The vulnerability is fixed in version 2.1.2. Users should upgrade to 2.1.2 or later. No workarounds are documented. The issue was reported via HackerOne [1].
AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
html-pagesnpm | <= 3.1.0 | — |
Affected products
2- HackerOne/html-pagesv5Range: <=2.1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-5p26-hw7f-3cprghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-16481ghsaADVISORY
- hackerone.com/reports/330356ghsax_refsource_MISCWEB
- www.npmjs.com/advisories/1001ghsaWEB
News mentions
0No linked articles in our index yet.