GHSA-FM8C-6M29-RP6J

Vulnerability from github – Published: 2026-02-25 16:04 – Updated: 2026-02-25 16:04
VLAI?
Summary
repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard
Details

Impact

The RepoCard component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's dangerouslySetInnerHTML to render the repository name (repo prop) during the loading state without any sanitization.

If a developer using this package passes unvalidated user input directly into the repo prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser.

Proof of Concept

import { RepoCard } from 'repostat';

function App() {
  const params = new URLSearchParams(window.location.search);
  const maliciousRepo = params.get('repo') || 'facebook/react';

  return <RepoCard repo={maliciousRepo} token="YOUR_TOKEN" />;
}

Remediation

Update to version 1.0.1. The use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities.

Severity ?
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "repostat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-25T16:04:41Z",
    "nvd_published_at": "2026-02-25T03:16:05Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React\u0027s `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. \n\nIf a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user\u0027s browser.\n\n### Proof of Concept\n```jsx\nimport { RepoCard } from \u0027repostat\u0027;\n\nfunction App() {\n  const params = new URLSearchParams(window.location.search);\n  const maliciousRepo = params.get(\u0027repo\u0027) || \u0027facebook/react\u0027;\n\n  return \u003cRepoCard repo={maliciousRepo} token=\"YOUR_TOKEN\" /\u003e;\n}\n```\n\n### Remediation\nUpdate to version 1.0.1. The use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities.",
  "id": "GHSA-fm8c-6m29-rp6j",
  "modified": "2026-02-25T16:04:41Z",
  "published": "2026-02-25T16:04:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27612"
    },
    {
      "type": "WEB",
      "url": "https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/denpiligrim/repostat"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.