PT-2026-21840 · Repostat · Repostat

Denpiligrim · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-27612

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Repostat versions prior to 1.0.1

Description Repostat, a React component used to display GitHub repository information, contains a Reflected Cross-Site Scripting (XSS) issue. The RepoCard component previously used dangerouslySetInnerHTML to render the repository name (repo prop) during the loading state without proper sanitization. This allowed for the execution of arbitrary JavaScript in a user's browser if an attacker could control the input passed into the repo prop. The issue was addressed in version 1.0.1 by removing the use of dangerouslySetInnerHTML and utilizing standard React JSX data binding for safe rendering.

Recommendations Update Repostat to version 1.0.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27612

GHSA-FM8C-6M29-RP6J

Produtos afetados

Repostat

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27612.json · Exploit
• https://github.com/denpiligrim/repostat · Nota
• https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j · Aviso do Fabricante
• https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88 · Correção
• https://t.me/cveNotify/153093 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-27612 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27612 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2026583896410783885 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2026641367762399520 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-fm8c-6m29-rp6j · Aviso do Fabricante