| 제목 | sheshbabu zen latest Improper Neutralization of Alternate XSS Syntax |
|---|
| 설명 | Zen is vulnerable to two stored cross-site scripting (XSS) vectors that allow an authenticated user to execute arbitrary JavaScript under the application origin.
Note titles and SQLite FTS5 search-highlight fields are both rendered into the DOM through Preact’s dangerouslySetInnerHTML without any HTML encoding. A payload stored via note create/update or .md import executes when the note editor mounts (title sink) or when the note matches a search query (search sink). The Markdown body path is not affected - renderMarkdown uses markdown-it with the default html: false, which escapes raw HTML; only the non-Markdown title and search-highlight code paths are vulnerable. Because the session_token cookie is script-readable, either vector is sufficient to hijack the victim’s session and take over the account. |
|---|
| 원천 | ⚠️ https://ctf-n0el4kls.notion.site/Store-XSS-in-sheshbabu-zen-3ae41990f44780dbadb6e6af57e6f833 |
|---|
| 사용자 | n0el4kls (UID 80089) |
|---|
| 제출 | 2026. 07. 31. AM 08:47 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 25. AM 10:24 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 409884 [sheshbabu zen 까지 1.5.0 Note Editor NotesEditor.jsx dangerouslySetInnerHTML 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 17 |
|---|