blitz-js vulnerabilities and threats

CVE-2026-9520 is a cross-site scripting (XSS) vulnerability in the blitz-js blitz framework affecting versions 3.0.0, 3.0.1, and 3.0.2. The issue exists in the Sign-in component, specifically in the LoginForm.tsx file, where manipulation of the Next argument can lead to XSS. The vulnerability can be exploited remotely and a public exploit is available. The vendor has not responded to the disclosure and no official fix or patch is currently known.