This vulnerability in blitz-js blitz up to version 3.0.2 allows remote attackers to perform cross-site scripting via manipulation of the Next argument in the LoginForm.tsx component of the Sign-in feature. The flaw enables injection of malicious scripts that execute in the context of the affected application. The vendor has not provided any remediation or patch, and the exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the user's browser session, potentially leading to session hijacking, credential theft, or other malicious actions. The vulnerability is remotely exploitable without privileges or user interaction beyond UI interaction. The CVSS 4.0 score is 5.3 (medium severity), reflecting the moderate impact and ease of exploitation.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for any forthcoming updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block XSS attack patterns targeting the affected component. Review and sanitize inputs related to the Next argument in the LoginForm.tsx component as a temporary mitigation.