{"id":"CVE-2024-9440","title":"Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability","summary":"Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. S…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-79","CWE-79"],"vendor":"slimselectjs","product":"slim_select","affected":["slim_select < 2.9.2"],"patched":["slim_select 2.9.2"],"published":"2024-10-02","updated":"2026-07-14","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-9440","references":[{"url":"https://github.com/brianvoe/slim-select/blob/e7e37e2ff90e125f846bd98d6b8f278524ead79e/src/slim-select/select.ts#L377","label":"disclosure@vulncheck.com"},{"url":"https://github.com/brianvoe/slim-select/issues/564","label":"disclosure@vulncheck.com"},{"url":"https://vulncheck.com/advisories/slim-select-xss","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00365,"epssPercentile":0.30266,"ingestedAt":"2026-07-14T23:40:05.095Z","slug":"CVE-2024-9440","body":"## Overview\n\nSlim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript. At this time, no patch is available.\n\n## Affected\n\n- `slim_select < 2.9.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `slim_select 2.9.2`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}