Stored XSS via HTML File Upload and Viewing
A stored XSS vulnerability was identified in version 0.2.2 of the software, allowing attackers to upload HTML files with XSS payloads that execute when viewed through the /view endpoint. This issue has not yet been patched.
Available publicly on Dec 13 2024
Remediation Steps
- Validate and sanitize all user inputs, especially file uploads, to ensure that HTML and JavaScript content cannot be executed.
- Implement Content Security Policy (CSP) headers to restrict the execution of scripts.
- Regularly update and patch the software to incorporate security fixes.
- Educate users on the risks of uploading and viewing untrusted files.
Patch Details
- Fixed Version: N/A
- Patch Commit: N/A
Want more out of Sightline?
Sightline offers even more for premium customers
Go Premium
We have - related security advisories that are available with Sightline Premium.