CVE-2026-27612

Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities.

• CWE-79

• https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88Patch
• https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6jExploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27607RustFS is a distributed object storage system built in Rust.…9.1
• CVE-2026-27608Parse Dashboard is a standalone dashboard for managing Parse…8.1
• CVE-2026-27609Parse Dashboard is a standalone dashboard for managing Parse…6.5
• CVE-2026-2761Sandbox escape in the Graphics: WebRender component. This vu…10
• CVE-2026-27610Parse Dashboard is a standalone dashboard for managing Parse…5.3
• CVE-2026-27611FileBrowser Quantum is a free, self-hosted, web-based file m…6.5
• CVE-2026-27613TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.8
• CVE-2026-27614Bugsink is a self-hosted error tracking tool. In versions pr…6.1
• CVE-2026-27615ADB Explorer is a fluent UI for ADB on Windows. In versions …7.8
• CVE-2026-27616Vikunja is an open-source self-hosted task management platfo…7.3
• CVE-2026-2762Integer overflow in the JavaScript: Standard Library compone…9.8
• CVE-2026-27621TypiCMS is a multilingual content management system based on…5.4