{"action":"Upgrade layui to 2.9.17 or later.","affected":[{"fixed":"2.9.17","introduced":"0"}],"component":"layui","cve_ids":["CVE-2024-47075"],"ecosystem":"npm","epss":0.00339,"exploited":false,"fixed_versions":["2.9.17"],"ghsa_id":"GHSA-j827-6rgf-9629","id":"tcs_01M5KFXB58BP28FSD4V0TDJ8BA","modified_at":"2025-08-15T16:25:42Z","published_at":"2024-09-26T17:54:24Z","references":["https://osv.dev/vulnerability/GHSA-j827-6rgf-9629","https://github.com/layui/layui/security/advisories/GHSA-j827-6rgf-9629","https://nvd.nist.gov/vuln/detail/CVE-2024-47075","https://github.com/layui/layui/commit/f756b41d63bf3d488a2cb042918638c9851bf2b0","https://github.com/layui/layui","https://layui.dev/notes/share/security-currentscript.html"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-j827-6rgf-9629","url":"https://osv.dev/vulnerability/GHSA-j827-6rgf-9629"}],"summary":"Layui has DOM Clobbering gadgets that leads to Cross-site Scripting"}