PT-2024-35706 · Habitica · Habitica

Kevin Stubbings · Published 2024-12-11 · Updated 2025-09-05 · CVE-2024-53273

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Habitica versions prior to 5.28.5

Description Habitica is an open-source habit-building program. The issue arises from a reflected cross-site scripting vulnerability due to an incorrect sanitization function in the register function within RegisterLoginReset.vue. An attacker can specify a malicious redirectTo parameter to trigger the vulnerability, potentially giving the attacker control of the victim's account when the victim registers or logs in with a specially crafted link.

Recommendations For versions prior to 5.28.5, update to version 5.28.5 to resolve the issue. As a temporary workaround, consider restricting access to the register function in RegisterLoginReset.vue until the patch is applied. Avoid using malicious redirectTo parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53273

Affected Products

Habitica

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53273.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica · Exploit
• https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-53273 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53273 · Vendor Advisory
• https://t.me/cveNotify/134513 · Telegram Post
• https://twitter.com/CVEnew/status/1867537652196544957 · Twitter Post