[GHSA-6gg3-pmm7-97xc] DOM-based XSS in auth0-lock

[nikpivkin]

Updates

• Affected products
• Severity
• Source code location

Comments
The range should end at < 11.26.3, not <= 11.25.1.

The fix auth0/lock@3711fb5 is in tag v11.26.3 and not in tags v11.26.0, v11.26.1 or v11.26.2.

So versions 11.26.0, 11.26.1 and 11.26.2 are still vulnerable but are outside the current range.

[nikpivkin]

The severity change from LOW to MODERATE is not something I edited. The CVSS vector is unchanged and scores 6.3, which is MODERATE. The form recomputed it.

[Copilot]

Copilot review overview

🟡 Changes recommended

The advisory has contradictory affected-version text and removes required range metadata.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Update affected-version text to versions before 11.26.3 · New

What changed in this PR

Updates the auth0-lock DOM-based XSS advisory to reflect the fix in version 11.26.3.

Changes:

• Extends the affected version range through 11.26.2.
• Adds the package repository reference.
• Updates severity to MODERATE.
• Removes range-specific affected-version metadata.

The advisory text still incorrectly ends the affected range at 11.25.1. Additionally, last_known_affected_version_range should be retained and updated to < 11.26.3.

File	Description
advisories/​github-reviewed/​2020/​08/​GHSA-6gg3-pmm7-97xc/​GHSA-6gg3-pmm7-97xc.json	Updates the advisory’s affected range, severity, and references; affected-version text and range metadata require correction.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.