CVE-2016-1000228: 
JavaScript vulnerability analysis and mitigation

The gmail-js library versions <= 0.6.4 contain a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue exists in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor, allowing potential execution of malicious code (GitHub Advisory).

The vulnerability stems from the library dynamically creating functions out of response data and executing them. Three specific instances were identified where user input is passed directly to the Function constructor without proper sanitization: in api.tools.parse_response, api.helper.get.visible_emails_post, and api.helper.get.email_data_post functions. This implementation could allow an attacker to inject and execute arbitrary JavaScript code (GitHub Issue).

The vulnerability allows attackers to execute arbitrary JavaScript code in the context of the web application using the gmail-js library. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the user's browser context (GitHub Advisory).

The vulnerability can be exploited when malicious data is passed through the affected functions. For example, if data containing JavaScript code like 'alert(1);' is passed to these functions, it would be executed in the context of the web application (GitHub Issue).

The vulnerability has been patched in version 0.6.5 of gmail-js. The fix involves replacing the use of new Function() with JSON.parse() for safer data handling. Users should update to version 0.6.5 or later to mitigate this vulnerability (GitHub Advisory).