Threat Investigation
Request a demo

CVE-2023-32325

Medium

Description

PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place.

SeverityMedium
CVSS5.4
Exploit probability—
ProductPosthog-js
PublishedMay 27, 2023
First seenMay 27, 2023
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • posthog posthog-js1.57.2 or later
  • posthog-js1.57.2 or later

Affected products

ProductAffected versionsFixed in
posthog posthog-jsv < 1.57.21.57.2
posthog-jsnpmv < 1.57.21.57.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.