Clear the Lineup: XSS via innerHTML in cyberbro — Found and Fixed by GSC
What I Fixed A Cross-Site Scripting (XSS) vulnerability in cyberbro (122 ⭐), an open-source OSINT platform. The search highlight feature used .innerHTML with unsanitized user input, allowing reflected XSS in search results. Found by: GSC (Git Security Checker) — self-learning SAST scanner. The Bug File: src/views/SearchView.js The search highlight function took user search terms and injected them…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.