Executive brief
Anonymous GitHub is a proxy service that allows users to browse GitHub repositories anonymously. The application fetches README files from GitHub and renders them in a web interface without properly sanitizing HTML content. An attacker can create a malicious repository with JavaScript code embedded in its README file, which will execute in the browser when viewed, potentially allowing account takeover and unauthorized access to other users' data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the markdown rendering pipeline. The application fetches README files via GitHub's REST API and stores them in MongoDB, then serves the raw markdown to the client. On the client side, the markdown is parsed using the marked library with sanitization explicitly disabled (sanitize: false), and the resulting HTML is injected into the DOM via AngularJS's $sce.trustAsHtml() and ng-bind-html directives, bypassing built-in XSS protections. An unauthenticated attacker can craft a malicious GitHub repository with embedded script tags or event handlers in the README, which will execute in the context of the Anonymous GitHub origin when any user views or anonymizes the repository. This allows theft of authentication tokens, session cookies, and access to other users' anonymization configurations and private data. The vulnerability affects version 2.2.0 and was patched in version 2.3.0.
Affected products
- tdurieux anonymous_github 2.2.0
Timeline
- 2026-05-05: disclosed
- 2026-05-05: patched: Fixed in version 2.3.0