CVE-2020-15119: 
JavaScript vulnerability analysis and mitigation

In auth0-lock versions before and including 11.25.1, a cross-site scripting (XSS) vulnerability was discovered due to the use of dangerouslySetInnerHTML to update the DOM. The vulnerability was disclosed on August 17, 2020, affecting the auth0-lock npm package (GitHub Advisory).

The vulnerability occurs when dangerouslySetInnerHTML is used to display informational messages in two specific scenarios: 1) With Passwordless connection, where the input value (email or phone number) is displayed while waiting for verification code input, and 2) With Enterprise connection, where the IdP Domain value from the Enterprise connection setup screen is displayed when the lock widget opens. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When Passwordless or Enterprise connection modes are used, applications and their users might be exposed to cross-site scripting (XSS) attacks, potentially allowing attackers to execute arbitrary code in the context of the affected application (GitHub Advisory).

The vulnerability is exploitable when using either Passwordless or Enterprise connection modes in the auth0-lock package. The attack requires user interaction and limited privileges to execute (NVD).

Users should upgrade to version 11.26.3 or later to address this vulnerability. The patch implementation does not impact user functionality and provides a complete fix for the XSS issue (GitHub Advisory).