CVE-2022-31094

ScratchTools is a web extension designed to make interacting with the Scratch programming language community (Scratching) easier. In affected versions anybody who uses the Recently Viewed Projects feature is vulnerable to having their account taken over if they view a project that tries to. The issue is that if a user visits a project that includes Javascript in the title, then when the Recently Viewed Projects feature displays it, it could run the Javascript. This issue has been addressed in the 2.5.2 release. Users having issues scratching should open an issue in the project issue tracker https://github.com/STForScratch/ScratchTools/

• CWE-79

• https://github.com/STForScratch/ScratchTools/commit/a29a0c6105bc14a89d25c806f6a3ad1257bbb683Patch, Third Party Advisory
• https://github.com/STForScratch/ScratchTools/releases/tag/v2.5.2Release Notes, Third Party Advisory
• https://github.com/STForScratch/ScratchTools/security/advisories/GHSA-6r45-jjw6-q39xThird Party Advisory
• https://github.com/STForScratch/ScratchTools/commit/a29a0c6105bc14a89d25c806f6a3ad1257bbb683Patch, Third Party Advisory
• https://github.com/STForScratch/ScratchTools/releases/tag/v2.5.2Release Notes, Third Party Advisory
• https://github.com/STForScratch/ScratchTools/security/advisories/GHSA-6r45-jjw6-q39xThird Party Advisory

Published

Jun 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31089Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-3109An issue was discovered in the FFmpeg package, where vp3_dec…7.5
• CVE-2022-31090Guzzle, an extensible PHP HTTP client. `Authorization` heade…7.7
• CVE-2022-31091Guzzle, an extensible PHP HTTP client. `Authorization` and `…7.7
• CVE-2022-31092Pimcore is an Open Source Data & Experience Management Platf…8.1
• CVE-2022-31093NextAuth.js is a complete open source authentication solutio…7.5
• CVE-2022-31095discourse-chat is a chat plugin for the Discourse applicatio…6.5
• CVE-2022-31096Discourse is an open source discussion platform. Under certa…5.7
• CVE-2022-31097Grafana is an open-source platform for monitoring and observ…8.7
• CVE-2022-31098Weave GitOps is a simple open source developer platform for …7.5
• CVE-2022-31099rulex is a new, portable, regular expression language. When …6.5
• CVE-2022-3110An issue was discovered in the Linux kernel through 5.16-rc6…5.5