WS-2014-0029 | Mend Vulnerability Database

Vulnerability DatabaseWS-2014-0029

WS-2014-0029

Published:May 19, 2026

Updated:May 19, 2026

Node text does not escape html in Jstree, This is a potential XSS issue.

Affected Packages

jstree (CDN_JS):

Affected version(s) >=3.0.0-beta10 <3.0.3

Fix Suggestion:

Update to version 3.0.3

bokeh (CONDA):

Affected version(s) >=0.4.4 <0.5.2

Fix Suggestion:

Update to version 0.5.2

bokeh (CONDA):

Affected version(s) >=0.6.0 <0.8.0

Fix Suggestion:

Update to version 0.8.0

jstree (NPM):

Affected version(s) >=3.0.0-beta10 <3.0.3

Fix Suggestion:

Update to version 3.0.3

jquery.jstree (NUGET):

Affected version(s) =3.0.1 <3.0.1.8

Fix Suggestion:

Update to version 3.0.1.8

jstree (NUGET):

Affected version(s) >=3.0.0-beta10 <3.1.1

Fix Suggestion:

Update to version 3.1.1

comboost.mvc.bootstrap (NUGET):

Affected version(s) >=0.1.3-alpha <=2.0.1

Fix Suggestion:

Update to version no_fix

nettree (NUGET):

Affected version(s) >=1.0.0 <=1.2.2

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.3.0 <v4.3.0

Fix Suggestion:

Update to version v4.3.0

impresspages/impresspages (PHP):

Affected version(s) =4.5.2 <v4.5.2

Fix Suggestion:

Update to version v4.5.2

boing6000/impresspages (PHP):

Affected version(s) =4.2.4 <v4.2.4

Fix Suggestion:

Update to version v4.2.4

impresspages/impresspages (PHP):

Affected version(s) =4.2.6 <v4.2.6

Fix Suggestion:

Update to version v4.2.6

boing6000/impresspages (PHP):

Affected version(s) =v5.0.0.x-dev <v5.0.1

Fix Suggestion:

Update to version v5.0.1

boing6000/impresspages (PHP):

Affected version(s) =4.2.3 <v4.2.3

Fix Suggestion:

Update to version v4.2.3

boing6000/plugin-kbnews (PHP):

Affected version(s) =1.0.1

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.7.0 <v4.7.0

Fix Suggestion:

Update to version v4.7.0

urbanway/construct (PHP):

Affected version(s) >=dev-dev <5.0.7

Fix Suggestion:

Update to version 5.0.7

vufind/vufind (PHP):

Affected version(s) >=v1.21.0 <v1.23.0

Fix Suggestion:

Update to version v1.23.0

boing6000/impresspages (PHP):

Affected version(s) =4.6.6 <v4.6.6

Fix Suggestion:

Update to version v4.6.6

rabbitcms/backend (PHP):

Affected version(s) >=0.5.11.15 <0.5.17.1

Fix Suggestion:

Update to version 0.5.17.1

impresspages/impresspages (PHP):

Affected version(s) =4.5.0 <v4.5.0

Fix Suggestion:

Update to version v4.5.0

sofia-holding/odoo-connector-bundle (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

impresspages/impresspages (PHP):

Affected version(s) =4.3.0 <v4.3.0

Fix Suggestion:

Update to version v4.3.0

vufind/vufind (PHP):

Affected version(s) >=dev-wcdiscovery <dev-demiankatz-patch-1

Fix Suggestion:

Update to version dev-demiankatz-patch-1

vufind/vufind (PHP):

Affected version(s) >=dev-legacy/stats <dev-pullrequest_accessib_turn-my-account-menu-into-ul

Fix Suggestion:

Update to version dev-pullrequest_accessib_turn-my-account-menu-into-ul

boing6000/impresspages (PHP):

Affected version(s) =4.2.5 <v4.2.5

Fix Suggestion:

Update to version v4.2.5

growtask/simflex (PHP):

Affected version(s) >=dev-feature/events <=3.3.18

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.6.0 <v4.6.0

Fix Suggestion:

Update to version v4.6.0

ems/cmsable-distribution (PHP):

Affected version(s) >=v0.1.7 <=v0.2.2

Fix Suggestion:

Update to version no_fix

impresspages/impresspages (PHP):

Affected version(s) =4.6.6 <v4.6.6

Fix Suggestion:

Update to version v4.6.6

impresspages/impresspages (PHP):

Affected version(s) =4.10.1.x-dev <v4.10.1

Fix Suggestion:

Update to version v4.10.1

ems/cmsable-distribution (PHP):

Affected version(s) =dev-master <v0.1

Fix Suggestion:

Update to version v0.1

boing6000/impresspages (PHP):

Affected version(s) =4.4.1 <v4.4.1

Fix Suggestion:

Update to version v4.4.1

impresspages/impresspages (PHP):

Affected version(s) =4.2.5 <v4.2.5

Fix Suggestion:

Update to version v4.2.5

ove/thesaurus-bundle (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.6.4 <v4.6.4

Fix Suggestion:

Update to version v4.6.4

vufind/vufind (PHP):

Affected version(s) =dev-accessibility-js <dev-accessibility-report

Fix Suggestion:

Update to version dev-accessibility-report

bariew/yii2-node-tree (PHP):

Affected version(s) >=dev-master <=2.0.1

Fix Suggestion:

Update to version no_fix

impresspages/impresspages (PHP):

Affected version(s) =4.6.2 <v4.6.2

Fix Suggestion:

Update to version v4.6.2

glushkovds/simplex-admin (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

impresspages/impresspages (PHP):

Affected version(s) =4.6.5 <v4.6.5

Fix Suggestion:

Update to version v4.6.5

boing6000/impresspages (PHP):

Affected version(s) =4.5.1 <v4.5.1

Fix Suggestion:

Update to version v4.5.1

boing6000/impresspages (PHP):

Affected version(s) =4.2.2 <v4.2.2

Fix Suggestion:

Update to version v4.2.2

fscakephp/bake-ext (PHP):

Affected version(s) =v1.0.0.x-dev

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.2.8 <v4.2.8

Fix Suggestion:

Update to version v4.2.8

boing6000/impresspages (PHP):

Affected version(s) =4.6.1 <v4.6.1

Fix Suggestion:

Update to version v4.6.1

impresspages/impresspages (PHP):

Affected version(s) =4.7.0 <v4.7.0

Fix Suggestion:

Update to version v4.7.0

jmleroux/zf-categories (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

vufind/vufind (PHP):

Affected version(s) >=26-beta-1 <dev-VUFIND-1342

Fix Suggestion:

Update to version dev-VUFIND-1342

boing6000/impresspages (PHP):

Affected version(s) =dev-patch-2 <v2.0

Fix Suggestion:

Update to version v2.0

boing6000/impresspages (PHP):

Affected version(s) =4.2.7 <v4.2.7

Fix Suggestion:

Update to version v4.2.7

boing6000/impresspages (PHP):

Affected version(s) =4.2.1 <v4.2.1

Fix Suggestion:

Update to version v4.2.1

impresspages/impresspages (PHP):

Affected version(s) =4.6.0 <v4.6.0

Fix Suggestion:

Update to version v4.6.0

bramas/cakephp2-admin (PHP):

Affected version(s) >=dev-master <=1.0.3

Fix Suggestion:

Update to version no_fix

vufind/vufind (PHP):

Affected version(s) >=RD1.01 <v1.20.0

Fix Suggestion:

Update to version v1.20.0

rabbitcms/backend (PHP):

Affected version(s) =dev-master <dev-next

Fix Suggestion:

Update to version dev-next

impresspages/impresspages (PHP):

Affected version(s) =4.4.2 <v4.4.2

Fix Suggestion:

Update to version v4.4.2

boing6000/impresspages (PHP):

Affected version(s) =4.6.2 <v4.6.2

Fix Suggestion:

Update to version v4.6.2

vufind/vufind (PHP):

Affected version(s) =v1.27.0 <v1.28.0

Fix Suggestion:

Update to version v1.28.0

vufind/vufind (PHP):

Affected version(s) >=dev-release-2.3 <dev-legacy/lbs4-daia

Fix Suggestion:

Update to version dev-legacy/lbs4-daia

vufind/vufind (PHP):

Affected version(s) >=dev-add-code-of-conduct <dev-autocomplete-troubleshooting

Fix Suggestion:

Update to version dev-autocomplete-troubleshooting

raindrop/page-bundle (PHP):

Affected version(s) >=dev-feature/alpha-version <=dev-feature/2.2.0

Fix Suggestion:

Update to version no_fix

impresspages/impresspages (PHP):

Affected version(s) =4.4.0 <v4.4.0

Fix Suggestion:

Update to version v4.4.0

impresspages/impresspages (PHP):

Affected version(s) >=dev-comoposer-experiment <v1.0.7

Fix Suggestion:

Update to version v1.0.7

crowdtruth/crowdtruth (PHP):

Affected version(s) >=dev-anca <dev-laravel

Fix Suggestion:

Update to version dev-laravel

impresspages/impresspages (PHP):

Affected version(s) =4.2.3 <v4.2.3

Fix Suggestion:

Update to version v4.2.3

impresspages/impresspages (PHP):

Affected version(s) =4.2.1 <v4.2.1

Fix Suggestion:

Update to version v4.2.1

glushkovds/simplex-admin (PHP):

Affected version(s) =dev-diplomarket <dev-fix/tables

Fix Suggestion:

Update to version dev-fix/tables

boing6000/plugin-kbnews (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

boing6000/impresspages (PHP):

Affected version(s) =4.6.5 <v4.6.5

Fix Suggestion:

Update to version v4.6.5

vufind/vufind (PHP):

Affected version(s) >=dev-feature/heroku <dev-legacy/mink-autoretry

Fix Suggestion:

Update to version dev-legacy/mink-autoretry

rabbitcms/backend (PHP):

Affected version(s) >=0.5.11 <0.5.11.14

Fix Suggestion:

Update to version 0.5.11.14

impresspages/impresspages (PHP):

Affected version(s) =4.6.4 <v4.6.4

Fix Suggestion:

Update to version v4.6.4

impresspages/impresspages (PHP):

Affected version(s) =4.6.1 <v4.6.1

Fix Suggestion:

Update to version v4.6.1

boing6000/impresspages (PHP):

Affected version(s) =4.4.2 <v4.4.2

Fix Suggestion:

Update to version v4.4.2

fscakephp/bake-ext (PHP):

Affected version(s) =dev-master <v1.0.0

Fix Suggestion:

Update to version v1.0.0

rabbitcms/backend (PHP):

Affected version(s) >=0.5.17.2 <0.6.8

Fix Suggestion:

Update to version 0.6.8

ezsystems/eztags-ls (PHP):

Affected version(s) =dev-1.4-stable <1.4.1

Fix Suggestion:

Update to version 1.4.1

glushkovds/simflex (PHP):

Affected version(s) >=dev-feature/events <=3.3.18

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.2.6 <v4.2.6

Fix Suggestion:

Update to version v4.2.6

impresspages/impresspages (PHP):

Affected version(s) =4.2.8 <v4.2.8

Fix Suggestion:

Update to version v4.2.8

boing6000/impresspages (PHP):

Affected version(s) =4.5.0 <v4.5.0

Fix Suggestion:

Update to version v4.5.0

impresspages/impresspages (PHP):

Affected version(s) =4.5.1 <v4.5.1

Fix Suggestion:

Update to version v4.5.1

impresspages/impresspages (PHP):

Affected version(s) =4.2.2 <v4.2.2

Fix Suggestion:

Update to version v4.2.2

vufind/vufind (PHP):

Affected version(s) >=dev-release-4.0 <dev-release-8.0

Fix Suggestion:

Update to version dev-release-8.0

impresspages/impresspages (PHP):

Affected version(s) =4.2.4 <v4.2.4

Fix Suggestion:

Update to version v4.2.4

impresspages/impresspages (PHP):

Affected version(s) =5.0.0 <v5.0.0

Fix Suggestion:

Update to version v5.0.0

intelliants/subrion (PHP):

Affected version(s) >=v4.1.5.10-dev <v4.2.0

Fix Suggestion:

Update to version v4.2.0

impresspages/impresspages (PHP):

Affected version(s) =4.4.1 <v4.4.1

Fix Suggestion:

Update to version v4.4.1

se7enxweb/eztags-ls (PHP):

Affected version(s) >=1.4 <2.0

Fix Suggestion:

Update to version 2.0

boing6000/impresspages (PHP):

Affected version(s) =4.5.2 <v4.5.2

Fix Suggestion:

Update to version v4.5.2

se7enxweb/eztags (PHP):

Affected version(s) >=1.4 <2.0

Fix Suggestion:

Update to version 2.0

impresspages/impresspages (PHP):

Affected version(s) =4.2.7 <v4.2.7

Fix Suggestion:

Update to version v4.2.7

ove/procedures-bundle (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

boing6000/impresspages (PHP):

Affected version(s) =4.4.0 <v4.4.0

Fix Suggestion:

Update to version v4.4.0

bokeh (PYTHON):

Affected version(s) >=0.6.0 <0.8.0

Fix Suggestion:

Update to version 0.8.0

bokeh (PYTHON):

Affected version(s) >=0.4.4 <0.5.2

Fix Suggestion:

Update to version 0.5.2

Related Resources (2)

https://github.com/vakata/jstree/commit/94f8f564bd01290d04ac1ec8e2e4b51b14fb15dc

https://github.com/vakata/jstree/issues/756

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

NONE

Vulnerable System Availability

NONE

Subsequent System Confidentiality

LOW

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE