x/vulndb: potential Go vuln in github.com/woodpecker-ci/woodpecker: CVE-2022-29947

[GoVulnBot]

CVE-2022-29947 references github.com/woodpecker-ci/woodpecker, which may be a Go module.

Description:
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

Links:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-29947
• JSON: https://github.com/CVEProject/cvelist/tree/dde26cab4882d5d41620e63926762c622c0955ec/2022/29xxx/CVE-2022-29947.json
• PR: Escape html / xml in log view woodpecker-ci/woodpecker#879
• https://github.com/woodpecker-ci/woodpecker/releases/tag/v0.15.1

See doc/triage.md for instructions on how to triage this report.

module: github.com/woodpecker-ci/woodpecker
package: n/a
description: |
    Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
cves:
  - CVE-2022-29947
links:
    pr: https://github.com/woodpecker-ci/woodpecker/pull/879
    context:
      - https://github.com/woodpecker-ci/woodpecker/releases/tag/v0.15.1

[neild]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/592767 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607218 mentions this issue: data/reports: unexclude 20 reports (16)