CVE-2023-1001: 
JavaScript vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability has been identified in xuliangzhan vxe-table versions up to 3.7.9. The vulnerability specifically affects the export function in the file packages/textarea/src/textarea.js of the vxe-textarea component. The issue was discovered and disclosed on May 24, 2024 (NVD).

The vulnerability stems from improper validation of the inputValue argument in the textarea.js export function. The manipulation of this argument can lead to cross-site scripting attacks. The vulnerability has been assigned a CVSS v4.0 score of 5.3 (MEDIUM) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, and a CVSS v3.1 score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers to perform cross-site scripting attacks through the manipulation of the inputValue argument. The attack can be initiated remotely, potentially affecting the integrity of the web application (NVD).

The vulnerability can be exploited remotely by manipulating the inputValue argument in the textarea component. The attack requires low attack complexity and low privileges to execute (NVD).

The vulnerability has been patched in version 3.7.10 of vxe-table. The fix is identified by commit d70b0e089740b65a22c89c106ebc4627ac48a22d. It is strongly recommended to upgrade the affected component to version 3.7.10 or later to address this security issue (NVD).