PT-2024-35705 · Habitica · Habitica

Kevin Stubbings · Published 2024-12-11 · Updated 2025-09-05 · CVE-2024-53272

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Habitica versions prior to 5.28.5

Description Habitica is an open-source habit-building program. The issue concerns reflected cross-site scripting vulnerabilities in the login and social media functions within RegisterLoginReset.vue, caused by an incorrect sanitization function. An attacker can exploit this by specifying a malicious redirectTo parameter, potentially giving them control of a victim's account when the victim registers or logs in with a specially crafted link.

Recommendations For versions prior to 5.28.5, update to version 5.28.5 to resolve the issue. As a temporary workaround, consider restricting access to the login and social media functions in RegisterLoginReset.vue until the update can be applied. Additionally, avoid using the redirectTo parameter in affected links until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53272

Affected Products

Habitica

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53272.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica · Exploit
• https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-53272 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53272 · Vendor Advisory
• https://t.me/cveNotify/134512 · Telegram Post
• https://twitter.com/CVEnew/status/1867537653307986158 · Twitter Post