| tiêu đề | sheshbabu zen latest Improper Neutralization of Alternate XSS Syntax |
|---|
| Mô tả | Zen is vulnerable to two stored cross-site scripting (XSS) vectors that allow an authenticated user to execute arbitrary JavaScript under the application origin.
Note titles and SQLite FTS5 search-highlight fields are both rendered into the DOM through Preact’s dangerouslySetInnerHTML without any HTML encoding. A payload stored via note create/update or .md import executes when the note editor mounts (title sink) or when the note matches a search query (search sink). The Markdown body path is not affected - renderMarkdown uses markdown-it with the default html: false, which escapes raw HTML; only the non-Markdown title and search-highlight code paths are vulnerable. Because the session_token cookie is script-readable, either vector is sufficient to hijack the victim’s session and take over the account. |
|---|
| Nguồn | ⚠️ https://ctf-n0el4kls.notion.site/Store-XSS-in-sheshbabu-zen-3ae41990f44780dbadb6e6af57e6f833 |
|---|
| Người dùng | n0el4kls (UID 80089) |
|---|
| Đệ trình | 31/07/2026 08:47 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 25/09/2026 10:24 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 409884 [sheshbabu zen đến 1.5.0 Note Editor NotesEditor.jsx dangerouslySetInnerHTML Tập lệnh chéo trang] |
|---|
| điểm | 17 |
|---|