Threats tagged 'ghsa-g5pg-j2rm-rmvx'

GoFound versions through 1.4.1 have a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can submit malicious document text to the /api/index endpoint, which is then indexed and returned unescaped by searcher/engine.go. The dashboard.vue component renders this content using v-html, causing script execution in an administrator's browser when a search matches the malicious document.