Medium severity6.4NVD Advisory· Published Aug 20, 2020· Updated Jun 17, 2026

CVE-2020-15119

Description

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
auth0-locknpm	< 11.26.3	11.26.3

Affected products

Auth0/Lock2 versions
cpe:2.3:a:auth0:lock:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:auth0:lock:*:*:*:*:*:*:*:*range: <=11.25.1
- (no CPE)range: <= 11.25.1
ghsa-coords
pkg:npm/auth0-lock
Range: < 11.26.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-6gg3-pmm7-97xcghsaADVISORY
github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xcnvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-15119ghsaADVISORY
github.com/auth0/lock/commit/3711fb5b42afd40073a61a58759251f51e768b1bghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000