GHSA-8c8c-4vfj-rrpc: 
JavaScript vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was identified in redis-commander, affecting versions from 0.0.0 to versions prior to 0.5.0. The vulnerability was discovered in the highlighterId parameter of the clipboard.swf component on hosts serving Redis Commander. This security issue was published to the GitHub Advisory Database on September 1, 2020, and received a low severity rating (GitHub Advisory).

The vulnerability exists in the highlighterId parameter of the clipboard.swf component, which can be exploited through cross-site scripting attacks. The proof of concept was verified using Firefox 57.0 on Windows 10 with Flash NPAPI Windows plugin installed. The vulnerability is tracked as GHSA-8c8c-4vfj-rrpc and is classified as CWE-79 (Cross-site Scripting) (GitHub Advisory).

The vulnerability could allow attackers to execute malicious scripts in the context of the user's browser session when Flash is installed and enabled. This could potentially lead to unauthorized access to user data or session information (GitHub Advisory).

The vulnerability requires Flash to be installed and enabled to be exploitable. A proof of concept exists demonstrating the exploitation using the URL pattern: http://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\%22))}%20catch(e)%20{alert(document.domain);}// (GitHub Advisory).

The vulnerability was patched in version 0.5.0 of redis-commander. Prior to updating, users are advised to either use an alternative, functionally equivalent package or exercise extreme caution by ensuring redis-commander is the only web page open and avoiding clicking on any links (GitHub Advisory).