npm package report

Is @novnc/novnc safe?

1 known vulnerability, worst severity MODERATE.

cvss
5.0

how bad it is if exploited, out of 10

epss
4.8%

chance of exploitation in the next 30 days

xyz score
not scored

CyberXYZ composite, out of 10

fig. 01 — GHSA-49rv-g7w5-m8xx, the advisory selected below

// advisories

GHSA-49rv-g7w5-m8xx

MODERATECVE-2017-18635

Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of include/ui.js and users of vncauto.html and vnc.html.

Affected
< 0.6.2
Fixed in
0.6.2
Weakness
CWE-79
Published
2020-08-28
Source
github

GHSANVDMITREreferencereferencereferencereferencereferencereferencereferencereferencereference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 02:45 UTC. The most recent advisory here was published 2020-08-28. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is @novnc/novnc safe? npm package security report | CyberXYZ