GHSA-h2p9-cr4h-px24

Source

https://github.com/advisories/GHSA-h2p9-cr4h-px24

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-h2p9-cr4h-px24/GHSA-h2p9-cr4h-px24.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h2p9-cr4h-px24

Aliases

CVE-2026-9520

Published

2026-05-26T13:30:53Z

Modified

2026-06-30T17:56:29Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Blitz has a Cross-site Scripting issue

Details

A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-30T17:39:56Z",
    "nvd_published_at":  "2026-05-26T02:16:40Z",
    "severity":  "LOW"
}

References

Affected packages

npm / blitz

Package

Name: blitz; View open source insights on deps.dev
Purl: pkg:npm/blitz

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-h2p9-cr4h-px24/GHSA-h2p9-cr4h-px24.json"