CyberRota Analysis
AI-GeneratedThe AdonisJS HTTP Server package in versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2 is vulnerable to cross-site scripting (XSS) due to improper handling of error messages in the default HTML exception response. This flaw allows attackers to inject and execute malicious JavaScript when users access a crafted missing-route URL, particularly when debug mode is disabled and no custom error handling is implemented. Developers using affected versions should prioritize updating to versions 8.2.1 or 9.1.0 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute attacker-controlled JavaScript when a victim opens it and no custom status page or JSON response handles the error. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response. This issue is fixed in versions 8.2.1 and 9.1.0.