Threats tagged 'ghsa-wjrx-rm4h-jrhj'

Huginn versions before 2026.11.05 have a stored cross-site scripting (XSS) vulnerability in the service_label helper. This flaw occurs because unescaped OAuth service display names are marked as html_safe, allowing authenticated attackers to inject JavaScript by connecting an OAuth account with crafted profile fields. When victims attach such accounts to Agents and view them, the malicious script executes, potentially exposing sensitive data such as Credentials, Agents, Events, and admin actions if the victim has administrative privileges.