WS-2014-0029 | Mend Vulnerability Database

Vulnerability DatabaseWS-2014-0029

WS-2014-0029

Published:May 14, 2026

Updated:May 14, 2026

Node text does not escape html in Jstree, This is a potential XSS issue.

Affected Packages

jstree (CDN_JS):

Affected version(s) >=3.0.0-beta10 <3.0.3

Fix Suggestion:

Update to version 3.0.3

bokeh (CONDA):

Affected version(s) >=0.6.0 <0.8.0

Fix Suggestion:

Update to version 0.8.0

bokeh (CONDA):

Affected version(s) >=0.4.4 <0.5.2

Fix Suggestion:

Update to version 0.5.2

jstree (NPM):

Affected version(s) >=3.0.0-beta10 <3.0.3

Fix Suggestion:

Update to version 3.0.3

jstree (NUGET):

Affected version(s) >=3.0.0-beta10 <3.1.1

Fix Suggestion:

Update to version 3.1.1

nettree (NUGET):

Affected version(s) >=1.0.0 <=1.2.2

Fix Suggestion:

Update to version no_fix

comboost.mvc.bootstrap (NUGET):

Affected version(s) >=0.1.3-alpha <=2.0.1

Fix Suggestion:

Update to version no_fix

jquery.jstree (NUGET):

Affected version(s) =3.0.1 <3.0.1.8

Fix Suggestion:

Update to version 3.0.1.8

impresspages/impresspages (PHP):

Affected version(s) =4.7.0 <v4.7.0

Fix Suggestion:

Update to version v4.7.0

boing6000/impresspages (PHP):

Affected version(s) =4.2.4 <v4.2.4

Fix Suggestion:

Update to version v4.2.4

boing6000/impresspages (PHP):

Affected version(s) =4.6.2 <v4.6.2

Fix Suggestion:

Update to version v4.6.2

boing6000/impresspages (PHP):

Affected version(s) =4.5.2 <v4.5.2

Fix Suggestion:

Update to version v4.5.2

urbanway/construct (PHP):

Affected version(s) >=dev-dev <5.0.7

Fix Suggestion:

Update to version 5.0.7

impresspages/impresspages (PHP):

Affected version(s) =4.6.0 <v4.6.0

Fix Suggestion:

Update to version v4.6.0

rabbitcms/backend (PHP):

Affected version(s) >=0.5.11.15 <0.5.17.1

Fix Suggestion:

Update to version 0.5.17.1

glushkovds/simflex (PHP):

Affected version(s) >=dev-feature/events <=3.3.18

Fix Suggestion:

Update to version no_fix

jmleroux/zf-categories (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

rabbitcms/backend (PHP):

Affected version(s) >=0.5.11 <0.5.11.14

Fix Suggestion:

Update to version 0.5.11.14

vufind/vufind (PHP):

Affected version(s) >=dev-feature/heroku <dev-legacy/mink-autoretry

Fix Suggestion:

Update to version dev-legacy/mink-autoretry

glushkovds/simplex-admin (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

se7enxweb/eztags (PHP):

Affected version(s) >=1.4 <2.0

Fix Suggestion:

Update to version 2.0

boing6000/impresspages (PHP):

Affected version(s) =v5.0.0.x-dev <v5.0.1

Fix Suggestion:

Update to version v5.0.1

sofia-holding/odoo-connector-bundle (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

vufind/vufind (PHP):

Affected version(s) =v1.27.0 <v1.28.0

Fix Suggestion:

Update to version v1.28.0

impresspages/impresspages (PHP):

Affected version(s) =4.5.0 <v4.5.0

Fix Suggestion:

Update to version v4.5.0

boing6000/impresspages (PHP):

Affected version(s) =4.5.0 <v4.5.0

Fix Suggestion:

Update to version v4.5.0

ove/procedures-bundle (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

vufind/vufind (PHP):

Affected version(s) >=dev-release-4.0 <dev-release-8.0

Fix Suggestion:

Update to version dev-release-8.0

impresspages/impresspages (PHP):

Affected version(s) =4.5.2 <v4.5.2

Fix Suggestion:

Update to version v4.5.2

boing6000/impresspages (PHP):

Affected version(s) =4.6.1 <v4.6.1

Fix Suggestion:

Update to version v4.6.1

boing6000/plugin-kbnews (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

rabbitcms/backend (PHP):

Affected version(s) =dev-master <dev-next

Fix Suggestion:

Update to version dev-next

impresspages/impresspages (PHP):

Affected version(s) =4.6.1 <v4.6.1

Fix Suggestion:

Update to version v4.6.1

impresspages/impresspages (PHP):

Affected version(s) >=dev-comoposer-experiment <v1.0.7

Fix Suggestion:

Update to version v1.0.7

impresspages/impresspages (PHP):

Affected version(s) =4.2.7 <v4.2.7

Fix Suggestion:

Update to version v4.2.7

boing6000/impresspages (PHP):

Affected version(s) =4.2.1 <v4.2.1

Fix Suggestion:

Update to version v4.2.1

bariew/yii2-node-tree (PHP):

Affected version(s) >=dev-master <=2.0.1

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.6.5 <v4.6.5

Fix Suggestion:

Update to version v4.6.5

impresspages/impresspages (PHP):

Affected version(s) =4.4.1 <v4.4.1

Fix Suggestion:

Update to version v4.4.1

impresspages/impresspages (PHP):

Affected version(s) =4.4.2 <v4.4.2

Fix Suggestion:

Update to version v4.4.2

vufind/vufind (PHP):

Affected version(s) =dev-accessibility-js <dev-accessibility-report

Fix Suggestion:

Update to version dev-accessibility-report

ezsystems/eztags-ls (PHP):

Affected version(s) =dev-1.4-stable <1.4.1

Fix Suggestion:

Update to version 1.4.1

boing6000/impresspages (PHP):

Affected version(s) =4.2.3 <v4.2.3

Fix Suggestion:

Update to version v4.2.3

rabbitcms/backend (PHP):

Affected version(s) >=0.5.17.2 <0.6.8

Fix Suggestion:

Update to version 0.6.8

glushkovds/simplex-admin (PHP):

Affected version(s) =dev-diplomarket <dev-fix/tables

Fix Suggestion:

Update to version dev-fix/tables

impresspages/impresspages (PHP):

Affected version(s) =4.2.2 <v4.2.2

Fix Suggestion:

Update to version v4.2.2

bramas/cakephp2-admin (PHP):

Affected version(s) >=dev-master <=1.0.3

Fix Suggestion:

Update to version no_fix

vufind/vufind (PHP):

Affected version(s) >=v1.21.0 <v1.23.0

Fix Suggestion:

Update to version v1.23.0

vufind/vufind (PHP):

Affected version(s) >=dev-release-2.3 <dev-legacy/lbs4-daia

Fix Suggestion:

Update to version dev-legacy/lbs4-daia

impresspages/impresspages (PHP):

Affected version(s) =4.6.4 <v4.6.4

Fix Suggestion:

Update to version v4.6.4

boing6000/plugin-kbnews (PHP):

Affected version(s) =1.0.1

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.6.4 <v4.6.4

Fix Suggestion:

Update to version v4.6.4

boing6000/impresspages (PHP):

Affected version(s) =4.7.0 <v4.7.0

Fix Suggestion:

Update to version v4.7.0

boing6000/impresspages (PHP):

Affected version(s) =4.2.6 <v4.2.6

Fix Suggestion:

Update to version v4.2.6

impresspages/impresspages (PHP):

Affected version(s) =4.4.0 <v4.4.0

Fix Suggestion:

Update to version v4.4.0

impresspages/impresspages (PHP):

Affected version(s) =4.2.3 <v4.2.3

Fix Suggestion:

Update to version v4.2.3

impresspages/impresspages (PHP):

Affected version(s) =4.2.8 <v4.2.8

Fix Suggestion:

Update to version v4.2.8

boing6000/impresspages (PHP):

Affected version(s) =4.4.2 <v4.4.2

Fix Suggestion:

Update to version v4.4.2

boing6000/impresspages (PHP):

Affected version(s) =4.2.7 <v4.2.7

Fix Suggestion:

Update to version v4.2.7

ems/cmsable-distribution (PHP):

Affected version(s) >=v0.1.7 <=v0.2.2

Fix Suggestion:

Update to version no_fix

vufind/vufind (PHP):

Affected version(s) >=RD1.01 <v1.20.0

Fix Suggestion:

Update to version v1.20.0

ove/thesaurus-bundle (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.2.2 <v4.2.2

Fix Suggestion:

Update to version v4.2.2

fscakephp/bake-ext (PHP):

Affected version(s) =dev-master <v1.0.0

Fix Suggestion:

Update to version v1.0.0

vufind/vufind (PHP):

Affected version(s) >=dev-wcdiscovery <dev-demiankatz-patch-1

Fix Suggestion:

Update to version dev-demiankatz-patch-1

impresspages/impresspages (PHP):

Affected version(s) =4.2.6 <v4.2.6

Fix Suggestion:

Update to version v4.2.6

impresspages/impresspages (PHP):

Affected version(s) =4.2.5 <v4.2.5

Fix Suggestion:

Update to version v4.2.5

intelliants/subrion (PHP):

Affected version(s) >=v4.1.5.10-dev <v4.2.0

Fix Suggestion:

Update to version v4.2.0

vufind/vufind (PHP):

Affected version(s) >=26-beta-1 <dev-VUFIND-1342

Fix Suggestion:

Update to version dev-VUFIND-1342

growtask/simflex (PHP):

Affected version(s) >=dev-feature/events <=3.3.18

Fix Suggestion:

Update to version no_fix

se7enxweb/eztags-ls (PHP):

Affected version(s) >=1.4 <2.0

Fix Suggestion:

Update to version 2.0

boing6000/impresspages (PHP):

Affected version(s) =4.6.6 <v4.6.6

Fix Suggestion:

Update to version v4.6.6

impresspages/impresspages (PHP):

Affected version(s) =5.0.0 <v5.0.0

Fix Suggestion:

Update to version v5.0.0

boing6000/impresspages (PHP):

Affected version(s) =4.3.0 <v4.3.0

Fix Suggestion:

Update to version v4.3.0

raindrop/page-bundle (PHP):

Affected version(s) >=dev-feature/alpha-version <=dev-feature/2.2.0

Fix Suggestion:

Update to version no_fix

fscakephp/bake-ext (PHP):

Affected version(s) =v1.0.0.x-dev

Fix Suggestion:

Update to version no_fix

crowdtruth/crowdtruth (PHP):

Affected version(s) >=dev-anca <dev-laravel

Fix Suggestion:

Update to version dev-laravel

boing6000/impresspages (PHP):

Affected version(s) =4.4.1 <v4.4.1

Fix Suggestion:

Update to version v4.4.1

boing6000/impresspages (PHP):

Affected version(s) =4.6.0 <v4.6.0

Fix Suggestion:

Update to version v4.6.0

boing6000/impresspages (PHP):

Affected version(s) =4.5.1 <v4.5.1

Fix Suggestion:

Update to version v4.5.1

boing6000/impresspages (PHP):

Affected version(s) =4.2.8 <v4.2.8

Fix Suggestion:

Update to version v4.2.8

vufind/vufind (PHP):

Affected version(s) >=dev-add-code-of-conduct <dev-autocomplete-troubleshooting

Fix Suggestion:

Update to version dev-autocomplete-troubleshooting

impresspages/impresspages (PHP):

Affected version(s) =4.6.6 <v4.6.6

Fix Suggestion:

Update to version v4.6.6

impresspages/impresspages (PHP):

Affected version(s) =4.2.1 <v4.2.1

Fix Suggestion:

Update to version v4.2.1

impresspages/impresspages (PHP):

Affected version(s) =4.5.1 <v4.5.1

Fix Suggestion:

Update to version v4.5.1

impresspages/impresspages (PHP):

Affected version(s) =4.6.2 <v4.6.2

Fix Suggestion:

Update to version v4.6.2

boing6000/impresspages (PHP):

Affected version(s) =4.2.5 <v4.2.5

Fix Suggestion:

Update to version v4.2.5

impresspages/impresspages (PHP):

Affected version(s) =4.10.1.x-dev <v4.10.1

Fix Suggestion:

Update to version v4.10.1

impresspages/impresspages (PHP):

Affected version(s) =4.3.0 <v4.3.0

Fix Suggestion:

Update to version v4.3.0

vufind/vufind (PHP):

Affected version(s) >=dev-legacy/stats <dev-pullrequest_accessib_turn-my-account-menu-into-ul

Fix Suggestion:

Update to version dev-pullrequest_accessib_turn-my-account-menu-into-ul

ems/cmsable-distribution (PHP):

Affected version(s) =dev-master <v0.1

Fix Suggestion:

Update to version v0.1

impresspages/impresspages (PHP):

Affected version(s) =4.6.5 <v4.6.5

Fix Suggestion:

Update to version v4.6.5

boing6000/impresspages (PHP):

Affected version(s) =dev-patch-2 <v2.0

Fix Suggestion:

Update to version v2.0

impresspages/impresspages (PHP):

Affected version(s) =4.2.4 <v4.2.4

Fix Suggestion:

Update to version v4.2.4

boing6000/impresspages (PHP):

Affected version(s) =4.4.0 <v4.4.0

Fix Suggestion:

Update to version v4.4.0

bokeh (PYTHON):

Affected version(s) >=0.4.4 <0.5.2

Fix Suggestion:

Update to version 0.5.2

bokeh (PYTHON):

Affected version(s) >=0.6.0 <0.8.0

Fix Suggestion:

Update to version 0.8.0

Related Resources (2)

https://github.com/vakata/jstree/issues/756

https://github.com/vakata/jstree/commit/94f8f564bd01290d04ac1ec8e2e4b51b14fb15dc

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

NONE

Vulnerable System Availability

NONE

Subsequent System Confidentiality

LOW

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE