EUVD-2026-31781
GHSA-h2p9-cr4h-px24
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on blitz (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.0.2.
DescriptionCVE.org
A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in blitz-js blitz (versions 3.0.0-3.0.2) allows remote attackers to inject malicious scripts via the 'Next' redirect parameter in the LoginForm component's Sign-in flow. The vulnerability requires passive user interaction (a victim must follow a crafted link) and is limited to low-integrity impact on the vulnerable system per CVSS 4.0 scoring. Publicly available exploit code exists (GitHub Gist), though EPSS stands at 0.03% (9th percentile) indicating low observed exploitation probability, and it is not listed in CISA KEV. The vendor did not respond to responsible disclosure, meaning no patch has been released.
Technical ContextAI
The affected code resides in packages/generator/templates/app/src/app/auth/components/LoginForm.tsx within the blitz-js blitz full-stack React framework (CPE: cpe:2.3:a:blitz-js:blitz:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored/Reflected XSS). The 'Next' parameter is a standard post-authentication redirect argument common in web auth flows; if its value is reflected into the page DOM without sanitization or encoding, an attacker can inject executable script content. Because this lives in a generator template, every application scaffolded using affected blitz versions likely inherits the vulnerable LoginForm code, potentially broadening the scope beyond a single application.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the responsible disclosure. Developers using blitz 3.0.0-3.0.2 should manually audit and remediate the LoginForm.tsx file in their generated applications. The specific fix is to sanitize or whitelist-validate the 'Next' redirect parameter before reflecting it into the DOM; acceptable values should be restricted to relative paths on the same origin (e.g., reject any value containing 'javascript:', '//', or external hostnames). React's JSX rendering provides some XSS protection when values are rendered as text nodes, but if the 'Next' value is used in an href or dangerouslySetInnerHTML context, explicit encoding or validation is mandatory. As a compensating control, a Content Security Policy (CSP) header restricting inline script execution can reduce XSS exploitability at the cost of additional configuration complexity. Monitor the blitz-js GitHub repository (https://github.com/blitz-js/blitz) for any upstream fix; the public exploit is tracked at https://gist.github.com/TrebledJ/164c7ca6c8208b63e6937bc11984720b.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today