Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27612 Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scri… https://www.cve.org/CVERecord?id=CVE-2026-27612
Post summary
CVE-2026-27612 identifies a reflected XSS flaw in Repostat’s RepoCard component before v1.0.1, with no PoC, exploit, or patch details provided.
CVE-2026-27612 Reflected XSS in Repostat React Component via Unsanitized Repository Name Prop https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27612
Post summary
A reflected XSS vulnerability (CVE-2026-27612) in Repostat’s React component due to an unsanitized repository name prop is disclosed, with no PoC, exploit, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | denpiligrim | repostat | - | node.js | - |