{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T09:38:03.839","vulnerabilities":[{"cve":{"id":"CVE-2026-27612","sourceIdentifier":"security-advisories@github.com","published":"2026-02-25T03:16:05.627","lastModified":"2026-06-17T10:27:23.673","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities."},{"lang":"es","value":"Repostat es un componente de React para obtener y mostrar información de repositorios de GitHub. Antes de la versión 1.0.1, el componente 'RepoCard' es vulnerable a cross-site scripting (XSS) reflejado. La vulnerabilidad ocurre porque el componente utiliza `dangerouslySetInnerHTML` de React para renderizar el nombre del repositorio (propiedad 'repo') durante el estado de carga sin ninguna sanitización. Si un desarrollador que utiliza este paquete pasa una entrada de usuario no validada directamente a la propiedad 'repo' (por ejemplo, leyéndola de un parámetro de consulta de URL), un atacante puede ejecutar JavaScript arbitrario en el contexto del navegador del usuario. En la versión 1.0.1, se ha eliminado el uso de `dangerouslySetInnerHTML`, y la propiedad 'repo' ahora se renderiza de forma segura utilizando el enlace de datos JSX estándar de React, que escapa automáticamente las entidades HTML."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"denpiligrim","product":"repostat","versions":[{"version":"< 1.0.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-02-26T21:06:53.595921Z","id":"CVE-2026-27612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:denpiligrim:repostat:*:*:*:*:*:node.js:*:*","versionEndExcluding":"1.0.1","matchCriteriaId":"2135D09A-17E3-4BEF-8B19-5400B9F8BC33"}]}]}],"references":[{"url":"https://github.com/denpiligrim/repostat/commit/715df5f73359d222fd7876e948d14290180e3c88","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/denpiligrim/repostat/security/advisories/GHSA-fm8c-6m29-rp6j","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}}]}