Threats affecting pkg:golang/glance

Glance versions from 0.7.9 up to but not including 0.8.8 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows malicious extension endpoints to inject JavaScript URLs via the Widget-Title-URL response header. When users click the widget title, the injected script executes, potentially allowing attackers to read dashboard pages through same-origin requests and exfiltrate content. The vulnerability is fixed in version 0.8.8.

Glance versions from 0.8.0 up to but not including 0.8.8 have a vulnerability where unauthenticated attackers can enumerate configured page slugs by observing differences in HTTP response status codes. This allows attackers to distinguish existing page names from non-existent ones by comparing 303/401 versus 404 responses when querying specific endpoints. The issue is fixed in version 0.8.8.