GitHub Advisoryadvisory · npm

GHSA-h2p9-cr4h-px24 Blitz has a Cross-site Scripting issue

LOW Published 2026-05-26 Modified 2026-06-30 Official page ↗
Aliases
CVE-2026-9520
Ecosystem
npm
Packages
blitz
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-06-30

Affected packages

• npm blitz: <= 3.0.2 (no fix yet)

Description

A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-9520 A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References