CVE-2021-32859: 
JavaScript vulnerability analysis and mitigation

The Baremetrics Date Range Picker (version 1.0.14 and prior) contains a Cross-site Scripting (XSS) vulnerability identified as CVE-2021-32859. The vulnerability was discovered in November 2021 and affects the calendar component of the application when handling untrusted placeholder entries (GitHub Security Lab).

The vulnerability exists in the Calendar component where an attacker who can influence the 'placeholder' field when creating a Calendar instance can supply arbitrary HTML or JavaScript code. This code will then be rendered in the context of a user, leading to Cross-site Scripting. The vulnerability is tracked as CWE-79 (GitHub Security Lab).

If successfully exploited, the vulnerability allows attackers to execute arbitrary JavaScript code in the context of the user's browser session, potentially leading to theft of sensitive information, session hijacking, or other malicious actions (GitHub Security Lab).

There are no known patches available for this vulnerability as the project is no longer maintained. The last update to the project was made before the vulnerability was disclosed, and the project was archived on April 13, 2022 (GitHub Security Lab).