Severity: high
Category: vulnerability
Triage Status: new
Validation: Human: valid | LLM: valid
Description
The user profile page does not properly sanitize user input before rendering it in the HTML. An attacker can inject malicious JavaScript code through the bio field that will execute in other users browsers when they view the profile.
Proof of Concept
- Navigate to profile settings
- Set bio to: <script>alert(document.cookie)</script>
- Save profile
- When another user views your profile, the script executes and displays their cookies
Vulnerable Code
File: src/components/UserProfile.tsx:78
<div className="bio">{user.bio}</div>
Metadata
- Finding ID: 850e8400-e29b-41d4-a716-446655440102
- Found By: hacktron_xss_scanner
- Validated By: hacktron_llm_validator
- Duplicate Of: N/A
- Reported At: 2025-12-03T17:11:37.303Z
This issue was automatically created by Hacktron security scanning.
Severity: high
Category: vulnerability
Triage Status: new
Validation: Human: valid | LLM: valid
Description
The user profile page does not properly sanitize user input before rendering it in the HTML. An attacker can inject malicious JavaScript code through the bio field that will execute in other users browsers when they view the profile.
Proof of Concept
Vulnerable Code
File:
src/components/UserProfile.tsx:78Metadata
This issue was automatically created by Hacktron security scanning.