CVE-2022-23466: teler dashboard vulnerable to DOM-based cross-site scripting (XSS)

December 6, 2022 (updated July 8, 2025)

teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard are not sanitized.

References

Code Behaviors & Features

Detect and mitigate CVE-2022-23466 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.0.0-20220625162531-2289e90590a9 before 0.0.0-20221203202318-20f59eda2420, all versions starting from 1.2.3-0.20220625162531-2289e90590a9 before 1.2.3-0.20221203202318-20f59eda2420, all versions starting from 2.0.0-dev before 2.0.0-dev.2, version 2.0.0-dev, all versions starting from 2.0.0-rc before 2.0.0-rc.4