FKIE_CVE-2026-27612

Vulnerability from fkie_nvd - Published: 2026-02-25 03:16 - Updated: 2026-02-27 19:08
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities.
References
security-advisories@github.comhttps://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88Patch
security-advisories@github.comhttps://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6jExploit, Vendor Advisory
Impacted products
Vendor Product Version
denpiligrim repostat *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:denpiligrim:repostat:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "2135D09A-17E3-4BEF-8B19-5400B9F8BC33",
              "versionEndExcluding": "1.0.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React\u0027s `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user\u0027s browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities."
    },
    {
      "lang": "es",
      "value": "Repostat es un componente de React para obtener y mostrar informaci\u00f3n de repositorios de GitHub. Antes de la versi\u00f3n 1.0.1, el componente \u0027RepoCard\u0027 es vulnerable a cross-site scripting (XSS) reflejado. La vulnerabilidad ocurre porque el componente utiliza `dangerouslySetInnerHTML` de React para renderizar el nombre del repositorio (propiedad \u0027repo\u0027) durante el estado de carga sin ninguna sanitizaci\u00f3n. Si un desarrollador que utiliza este paquete pasa una entrada de usuario no validada directamente a la propiedad \u0027repo\u0027 (por ejemplo, ley\u00e9ndola de un par\u00e1metro de consulta de URL), un atacante puede ejecutar JavaScript arbitrario en el contexto del navegador del usuario. En la versi\u00f3n 1.0.1, se ha eliminado el uso de `dangerouslySetInnerHTML`, y la propiedad \u0027repo\u0027 ahora se renderiza de forma segura utilizando el enlace de datos JSX est\u00e1ndar de React, que escapa autom\u00e1ticamente las entidades HTML."
    }
  ],
  "id": "CVE-2026-27612",
  "lastModified": "2026-02-27T19:08:59.367",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-25T03:16:05.627",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.