CVE-2026-27612: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27612 is a Reflected Cross-Site Scripting (XSS) vulnerability in the RepoCard component of the repostat npm package, a React component used to fetch and display GitHub repository information. The vulnerability affects all versions of repostat prior to 1.0.1 and was disclosed by the package author on February 21, 2026, with NVD publication on February 25, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Security Advisory).

The root cause is improper neutralization of user-controlled input (CWE-79): the RepoCard component uses React's dangerouslySetInnerHTML to render the repo prop during the loading state without any sanitization or escaping. If a developer passes unvalidated user input — such as a URL query parameter — directly into the repo prop, an attacker can inject arbitrary HTML/JavaScript that is executed in the victim's browser. The advisory includes a proof-of-concept demonstrating how reading the repo value from window.location.search and passing it directly to <RepoCard repo={maliciousRepo} /> triggers the vulnerability (Security Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's browser session, with a changed scope affecting resources beyond the vulnerable component itself. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the user, or full browser session compromise. Confidentiality and integrity are both assessed as low impact, and availability is not affected (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory and demonstrates the attack with minimal complexity — no privileges are required, but user interaction (clicking a crafted link) is necessary. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.029–0.052%, placing it in the 17th percentile for exploitation likelihood (GitHub Advisory, Security Advisory). This vulnerability is not listed in the CISA KEV catalog.

1. Identify vulnerable applications: Find web applications that use the repostat npm package (versions < 1.0.1) and pass URL query parameters directly into the repo prop of the RepoCard component.
2. Craft a malicious URL: Construct a URL targeting the vulnerable application with a repo query parameter containing an XSS payload, e.g., https://example.com/app?repo=<img src=x onerror=alert(document.cookie)>.
3. Deliver the link to a victim: Send the crafted URL to a target user via phishing email, social engineering, or by embedding it in a malicious webpage.
4. Trigger XSS execution: When the victim visits the URL, the application reads the repo parameter and passes it unsanitized to RepoCard, which renders it via dangerouslySetInnerHTML during the loading state, executing the injected JavaScript in the victim's browser.
5. Achieve objective: The executed script can steal session cookies, exfiltrate sensitive data, perform actions on behalf of the user, or redirect the victim to a malicious site (Security Advisory).

• Network: HTTP requests to application pages with repo query parameters containing HTML tags, JavaScript event handlers (e.g., onerror, onload), or encoded script content (e.g., %3Cscript%3E).
• Logs: Web server or application access logs showing GET requests with suspicious repo parameter values containing angle brackets, <script>, or JavaScript URIs.
• Browser/Client-Side: Unexpected outbound requests from the user's browser to external domains shortly after loading a page using the RepoCard component; JavaScript errors related to XSS payload execution in browser console logs.

The primary remediation is to upgrade the repostat npm package to version 1.0.1 or later, in which dangerouslySetInnerHTML has been replaced with standard React JSX data binding that automatically escapes HTML entities (Patch Commit). As an interim workaround for applications that cannot immediately upgrade, developers should validate and sanitize all user-supplied input before passing it to the repo prop, and avoid reading URL parameters directly into the component without sanitization. Additionally, implementing a strict Content Security Policy (CSP) header can reduce the impact of any XSS vulnerabilities by restricting script execution sources (Security Advisory).