CVE-2016-1000234: 
JavaScript vulnerability analysis and mitigation

jqTree versions 1.3.3 and earlier contain a cross-site scripting (XSS) vulnerability in the drag and drop functionality for modifying tree data (GitHub Advisory, NPM Advisory). The vulnerability was disclosed in July 2016 and assigned CVE-2016-1000234.

The vulnerability exists in the drag and drop functionality that allows modifying tree data hierarchy. When a user attempts to drag a node to a different position in the hierarchy, any malicious script content existing within the node will be executed (GitHub Advisory). The vulnerability is classified as CWE-79: Cross-site Scripting and has been assigned a High severity rating.

This vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers when they interact with the drag and drop functionality. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user (GitHub Advisory).

The vulnerability can be exploited by creating a node with malicious script content and having a user drag that node to a different position in the tree hierarchy. A proof of concept was demonstrated using a test case where a node label contained an XSS vector (GitHub Issue).

Users should update to jqTree version 1.3.4 or later which contains a fix for this vulnerability (GitHub Advisory).