Threats affecting pkg:github/language-system

22 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	4.8	EPSS 0.2%	CVE-2026-34097guardian language-system · Cross-site Scripting Medium4.8EPSS 0.2%2026-07-01CVE Database V5CVE-2026-34097 Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in text_file.php (lines 94, 101, 323, 403, 826, 852). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-07-01
Medium	4.8	EPSS 0.2%	CVE-2026-34096guardian language-system · Cross-site Scripting Medium4.8EPSS 0.2%2026-07-01CVE Database V5CVE-2026-34096 Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribute in designer.php (line 57). An authenticated attacker can craft a URL containing script tags that execute in the victim's browser session. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-07-01

Page 2 of 2