CVE-2026-27612 Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard
Attackers can execute arbitrary JavaScript in user browsers via unsanitized repository names in the Repostat React component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27612?
CVE-2026-27612 is a medium-severity cross-site scripting vulnerability in denpiligrim repostat, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Repostat is a React component to fetch and display GitHub repository info. Prior to version 1.0.1, the `RepoCard` component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React's `dangerouslySetInnerHTML` to render the repository name (`repo` prop) during the loading state without any sanitization. If a developer using this package passes unvalidated user input directly into the `repo` prop (for example, reading it from a URL query parameter), an attacker can execute arbitrary JavaScript in the context of the user's browser. In version 1.0.1, the use of dangerouslySetInnerHTML has been removed, and the repo prop is now safely rendered using standard React JSX data binding, which automatically escapes HTML entities.
Weakness: CWE-79
Which versions are affected by CVE-2026-27612?
2 open source packages ship an affected version, including repostat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
repostat npm | All versions | 1.0.1 |
repostat npm | All versions | 1.0.1 |
Products include Denpiligrim Repostat.
How do I fix CVE-2026-27612?
Upgrade repostat to 1.0.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-27612 being exploited?
There is no known exploitation of CVE-2026-27612 in the wild and no public exploit code.
Sources
Also known as GHSA-fm8c-6m29-rp6j.