Cross-site Scripting in @spscommerce/ds-react
Impact
XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS.
Patches
The code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher
Workarounds
This is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @spscommerce/ds-react | >= 4.12.2, < 7.17.4 | 7.17.4 |
References
- Weakness (CWE)
CWE-79- Platform
- npm
- Package
@spscommerce/ds-react- Disclosed
- 15.12.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-cfxh-frx4-9gjg - CC BY 4.0
Vulnerability history: @spscommerce/ds-react
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.