{"id":"CVE-2026-27612","aliases":["GHSA-fm8c-6m29-rp6j"],"url":"https://o3.security/vulnerability/CVE-2026-27612","summary":"Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard","details":"### Impact\nThe `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. \n\nIf a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser.\n\n### Proof of Concept\n```jsx\nimport { RepoCard } from 'repostat';\n\nfunction App() {\n  const params = new URLSearchParams(window.location.search);\n  const maliciousRepo = params.get('repo') || 'facebook/react';\n\n  return <RepoCard repo={maliciousRepo} token=\"YOUR_TOKEN\" />;\n}\n```\n\n### Remediation\nUpdate to version 1.0.1. The use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities.","published":"2026-02-25T02:38:05.548Z","modified":"2026-11-04T10:30:18.435786169Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"repostat","fixedVersion":"1.0.1"}],"fix":{"url":"https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88","label":"denpiligrim/repostat@715df5f"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27612.json"},{"type":"ADVISORY","url":"https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27612"},{"type":"FIX","url":"https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88"},{"type":"PACKAGE","url":"https://github.com/denpiligrim/repostat"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-04T10:30:18.435786169Z"}}