Executive brief
The RepoCard component in the repostat npm package is vulnerable to reflected cross-site scripting (XSS) attacks. Developers using this library in web applications could inadvertently allow attackers to execute malicious JavaScript in users' browsers if they pass unsanitized input (such as URL query parameters) to the repo property. This can lead to account compromise, session hijacking, or data theft.
Technical details
The RepoCard component uses React's dangerouslySetInnerHTML to render the repository name (repo prop) during the loading state without proper sanitization. This allows arbitrary HTML and JavaScript injection when an attacker controls the repo parameter value. The vulnerability requires network access and user interaction (the victim must visit a crafted URL), but no authentication or privileges are needed. An attacker can execute arbitrary JavaScript in the context of the user's browser session. The issue has been patched in version 1.0.1, which replaced dangerouslySetInnerHTML with standard React JSX data binding that automatically escapes HTML entities.
Affected products
- repostat repostat < 1.0.1
Timeline
- 2026-02-21: disclosed
- 2026-02-25: advisory