Threats tagged 'ghsa-mfr7-qrjx-rpgx'

Hydro @hydrooj/ui-default versions before 4.59.1 have a stored cross-site scripting (XSS) vulnerability. Registered users can inject malicious scripts via double quotes in language-class tokens within markdown-it-xss.ts. This allows attackers to store payloads in their profile bios that execute when viewed by administrators or other users, potentially stealing session cookies and enabling session hijacking.