Executive brief
A vulnerability in the Scalar Astro library's proxy component allows attackers to execute malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker can steal session information, redirect users to phishing websites, or perform unauthorized actions on the user's behalf. This affects the security and trustworthiness of applications using the Scalar documentation proxy.
Technical details
The vulnerability exists in the Scalar Proxy endpoint of the scalar/astro package (v0.1.13). The 'scalar_url' query parameter accepts an arbitrary URL pointing to an external SVG file, which the proxy fetches and serves to the user's browser without sanitization or a restrictive Content Security Policy (CSP). Because SVG files can contain embedded JavaScript, an attacker can host a malicious SVG that executes scripts in the context of the proxy's domain (e.g., proxy.scalar.com). This results in Reflected Cross-Site Scripting (XSS) and can also be used for Open Redirects. The root cause is the failure to strip script tags from SVG content and the lack of origin restrictions on the upstream URL.
Affected products
- Scalar astro 0.1.13
Timeline
- 2026-05-19: disclosed: Vulnerability details published on GitHub and NVD
- 2026-05-19: advisory