Packagist · slim/slim
Slim has Reflected XSS in the HtmlErrorRenderer
If an application uses HttpException::setTitle() and/or setDescription() to include untrusted/request-derived data in the error title or description (e.g. "No products found matching '{$query}'."), an attacker could inject arbitrary HTML/JavaScript that executes in the victim's browser when they encounter an HTML error page generated by Slim.
The vulnerability is present even with displayErrorDetails = false as the unescaped title and description are rendered on this error path.
Built-in exceptions (HttpNotFoundException, HttpBadRequestException, etc.) ship plain-text defaults, so a vanilla Slim app with no user code is not exploitable. Only applications that feed untrusted data into setTitle() and/or setDescription() are affected.
The issue is fixed in 4.15.2.
Without upgrading, applications can:
HttpException::setTitle() and setDescription(). Use static, plain-text error copy instead.ErrorRendererInterface implementation, or a subclass of HtmlErrorRenderer that escapes the title and description) for the HTML media type.Slim is grateful to and thanks GitHub user 0xEr3n for reporting this issue.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.