description: Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
problem types: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
affected:
{
product: shout node module
vendor: HackerOne
versions:
status: affected, version: >=0.44.0 <=0.49.3
}