Advisory Weakness Curation

DOM-based XSS in gmail-js Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor. ## Recommendation Update to version 0.6.5 or later.

DOM-based XSS Three functions exposed by the Gmail.js API (not the Google Gmail API) are vulnerable to DOM-based cross site scripting https://www.owasp.org/index.php/DOM_Based_XSS (DOMXSS). The three functions are `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post`. Each one of these functions calls `new Function()` with user data passed as the argument./n/nThis vulnerability is being disclosed before a public patched version is available because the issue was reported in a public Github issue.