We recently completed a security review of our corporate website, where we are using the Markit Slideshow module on our homepage. The security company we commissioned identified an XSS vulnerability in the Markit module specifically in the CSSHandler.ashx file. Can you confirm if a fix is available for this?

Many thanks.

Mike Palmer.
Webmaster.
Brand-Rex Ltd.

Hello,

Our CSS handler only loads a CSS file and replaces some tokens with the values we send to it.

It does not connect to database and does not affect on any file except template.css files.

I will send you source of our CSS handler right now.

Please check it out and let us know if there is something XSS Vulnerability on this.