CVE-2020-28470: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-28470 affects the package @scullyio/scully before version 1.0.9. The vulnerability was discovered and disclosed on January 6, 2021, and involves a Cross-site Scripting (XSS) issue where the transfer state is serialized with the JSON.stringify() function and then written into the HTML page without proper encoding (Snyk Advisory).

The vulnerability is classified as a Cross-site Scripting (XSS) issue with a CVSS v3.1 base score of 6.1 (MEDIUM) according to NVD, while Snyk rates it at 7.3 (HIGH). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that it is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability is related to improper neutralization of input during web page generation (NVD).

The vulnerability could lead to the disclosure of sensitive memory and allow attackers to bypass security mitigations such as ASLR. When exploited, it could enable attackers to execute malicious scripts in the context of the affected web application, potentially leading to cookie theft, session hijacking, or delivery of malware (Snyk Advisory).

The vulnerability requires user interaction to be exploited, and Snyk has indicated the existence of a proof-of-concept or detailed explanation of how to exploit this vulnerability. The EPSS score is 0.07% (33rd percentile), suggesting a relatively low probability of exploitation in the wild (Snyk Advisory).

The recommended mitigation is to upgrade @scullyio/scully to version 1.0.9 or higher. A fix was implemented through a pull request that prevents possible XSS attacks by encoding embedded JSON (GitHub PR).