GitHub Advisoryadvisory · npm

GHSA-vggc-6pg2-xvp9 Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling

MEDIUM Published 2026-03-16 Modified 2026-03-20 Official page ↗
Aliases
CVE-2026-32774
Ecosystem
npm
Packages
vulnogram
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-03-20

Affected packages

• npm vulnogram: <= 1.0.0 (no fix yet)

Description

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.

Related

Alias · CVE (1)

  • CVE-2026-32774 Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References