GitHub Advisoryadvisory · npm

GHSA-9jmq-xgjm-p8c2 Sync-in Server has a stored cross-site scripting (XSS) vulnerability

MEDIUM Published 2026-02-20 Modified 2026-02-20 Official page ↗
Aliases
CVE-2025-67438
Ecosystem
npm
Packages
@sync-in/server
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2026-02-20

Affected packages

• npm @sync-in/server: < 1.9.3 → fixed in 1.9.3

Description

A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.

Related

Alias · CVE (1)

  • CVE-2025-67438 A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References