Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor.

Recommendation

Update to version 0.6.5 or later.

References

• KartikTalwar/gmail.js#281
• KartikTalwar/gmail.js@a83436f
• https://www.npmjs.com/advisories/125
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000228