CVE-2026-27612

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27612", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T19:43:14.602Z", "datePublished": "2026-02-25T02:38:05.548Z", "dateUpdated": "2026-11-03T22:13:22.458Z"}, "containers": {"cna": {"title": "Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j"}, {"name": "https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88", "tags": ["x_refsource_MISC"], "url": "https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88"}], "affected": [{"vendor": "denpiligrim", "product": "repostat", "versions": [{"version": "< 1.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:38:05.548Z"}, "descriptions": [{"lang": "en", "value": "Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities."}], "source": {"advisory": "GHSA-fm8c-6m29-rp6j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27612", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:19:51.932568Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:13:22.458Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27612", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T19:43:14.602Z", "datePublished": "2026-02-25T02:38:05.548Z", "dateUpdated": "2026-11-03T22:13:22.458Z"}, "containers": {"cna": {"title": "Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j"}, {"name": "https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88", "tags": ["x_refsource_MISC"], "url": "https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88"}], "affected": [{"vendor": "denpiligrim", "product": "repostat", "versions": [{"version": "< 1.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T02:38:05.548Z"}, "descriptions": [{"lang": "en", "value": "Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities."}], "source": {"advisory": "GHSA-fm8c-6m29-rp6j", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27612", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:19:51.932568Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:58:39.420Z"}}]}}

{"affected": [{"affectedData": [{"product": "repostat", "vendor": "denpiligrim", "versions": [{"status": "affected", "version": "< 1.0.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:denpiligrim:repostat:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "2135D09A-17E3-4BEF-8B19-5400B9F8BC33", "versionEndExcluding": "1.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities."}, {"lang": "es", "value": "Repostat es un componente de React para obtener y mostrar informaci\u00f3n de repositorios de GitHub. Antes de la versi\u00f3n 1.0.1, el componente 'RepoCard' es vulnerable a cross-site scripting (XSS) reflejado. La vulnerabilidad ocurre porque el componente utiliza `dangerouslySetInnerHTML` de React para renderizar el nombre del repositorio (propiedad 'repo') durante el estado de carga sin ninguna sanitizaci\u00f3n. Si un desarrollador que utiliza este paquete pasa una entrada de usuario no validada directamente a la propiedad 'repo' (por ejemplo, ley\u00e9ndola de un par\u00e1metro de consulta de URL), un atacante puede ejecutar JavaScript arbitrario en el contexto del navegador del usuario. En la versi\u00f3n 1.0.1, se ha eliminado el uso de `dangerouslySetInnerHTML`, y la propiedad 'repo' ahora se renderiza de forma segura utilizando el enlace de datos JSX est\u00e1ndar de React, que escapa autom\u00e1ticamente las entidades HTML."}], "id": "CVE-2026-27612", "lastModified": "2026-11-03T23:17:41.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27612", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T21:19:51.932568Z", "version": "2.0.3"}}]}, "published": "2026-02-25T03:16:05.627", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "repostat", "source": "cna", "vendor": "denpiligrim"}, "product": "repostat", "vendor": "denpiligrim"}], "analysis": {"en": {"generated_at": "2026-04-17T15:30:09.044407+00:00", "value": {"mitigation_remediation": ["Upgrade the repostat package to version 1.0.1 or later, which removes the use of dangerouslySetInnerHTML.", "If an upgrade is not immediately possible, refactor any instances of RepoCard to eliminate dangerouslySetInnerHTML and validate or sanitize the repo prop before rendering, for example by escaping HTML entities or using a whitelisted format.", "Conduct a client\u2011side security audit to identify any remaining unsanitized inputs that could still lead to reflected XSS within your application."], "summary": {"action": "Patch Now", "impact": "Client\u2011side code execution via reflected XSS"}, "threat_synthesis": {"affected_systems": "The software affected is denpiligrim repostat. Any usage of the RepoCard component in versions prior to 1.0.1 is vulnerable. The component\u2019s vulnerability is tied specifically to the handling of the repo prop. All installations of repostat that pull older versions, whether from npm, yarn, or direct repository, are at risk until they upgrade to v1.0.1 or later.", "description_and_impact": "The vulnerability stems from the RepoCard component rendering the repository name through React's dangerouslySetInnerHTML during its loading state. Because the component does not sanitize the repo prop, an attacker can supply arbitrary HTML or JavaScript, such as via a URL query parameter, that will be executed in the context of any user who loads the page. This allows an attacker to steal session cookies, hijack user sessions, or otherwise compromise the integrity and confidentiality of the client\u2019s browser session. The weakness is a classic reflected cross\u2011site scripting flaw noted as CWE\u201179. The impact is strictly client\u2011side and does not affect the server or the underlying GitHub data.", "risk_and_exploitability": "The CVSS score of 6.1 classifies the issue as moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA\u2019s KEV catalog. The most likely exploitation scenario involves a malicious link that includes a crafted repo query parameter; a user clicking the link would trigger the XSS payload. No elevated privileges are required, but the attacker must convince a user to visit the crafted URL. The affected scope is limited to the affected client\u2019s browser session, but the consequences can be severe if the page holds sensitive information or authentication cookies."}}}}, "created": "2026-02-25T11:34:57.957454+00:00", "updated": "2026-04-17T15:45:15.879055+00:00", "vendors": ["denpiligrim", "denpiligrim$PRODUCT$repostat"]}