This vulnerability affects blitz-js blitz versions up to 3.0.2, specifically in the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx. An attacker can manipulate the Next argument in the Sign-in component to perform cross-site scripting attacks remotely. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The vendor has not provided any response or patch, and no remediation level is indicated in the available data.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application’s users, potentially leading to session hijacking, credential theft, or other malicious actions depending on the application context. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the lack of vendor response and patch means users remain exposed if they use affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is available from the vendor, users should consider mitigating exposure by restricting access to affected endpoints, employing web application firewalls with XSS detection, or upgrading to later versions if available. Monitor for vendor updates regarding patches or official mitigations.