Orejime Consent Manager Vulnerability Allows Execution of Embedded JavaScript Code

A vulnerability in Orejime, a consent manager focused on accessibility, prior to version 2.3.2, allows for the execution of malicious code by embedding 'javascript:' URLs within data attributes. When a user consents to the related purpose, Orejime converts these data attributes into unprefixed ones, such as 'data-href' into 'href', thereby executing the embedded code. This issue is likely to affect only those who can inject HTML into pages, as most elements managed by Orejime are hardcoded.

Impact

Exploitation of this vulnerability could lead to the execution of arbitrary JavaScript code in the context of the affected page.

Remediation

Users can update to Orejime version 2.3.2, where this vulnerability has been patched. Additionally, attributes that could contain executable code can be sanitized to remove the risk of code execution.