PT-2024-35707 · Habitica · Habitica

Kevin Stubbings · Published 2024-12-11 · Updated 2025-09-05 · CVE-2024-53274

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Habitica versions prior to 5.28.5

Description Habitica is an open-source habit-building program. The issue arises from a reflected cross-site scripting vulnerability in the register function in home.vue, caused by an incorrect sanitization function. An attacker can specify a malicious redirectTo parameter to trigger the vulnerability, allowing arbitrary JavaScript code to be executed in the context of the victim's session.

Recommendations For versions prior to 5.28.5, update to version 5.28.5 to resolve the issue. As a temporary workaround, consider restricting access to the register function in home.vue to minimize the risk of exploitation. Avoid using the redirectTo parameter in the affected function until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-53274

Affected Products

Habitica

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53274.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica · Exploit
• https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf · Patch
• https://osv.dev/vulnerability/CVE-2024-53274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53274 · Security Note
• https://t.me/cveNotify/134514 · Telegram Post
• https://twitter.com/CVEnew/status/1867537651034665291 · Twitter Post