# GHSA-g485-8j3v-p6x8: Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub's API and renders it without sanitization.

> Attackers can execute arbitrary JavaScript in the Anonymous GitHub origin by crafting malicious repository READMEs, potentially leading to account takeover.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 5 May 2026

## What is GHSA-g485-8j3v-p6x8?

GHSA-g485-8j3v-p6x8 is a cross-site scripting vulnerability in @tdurieux/anonymous_github, published on 5 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

### Summary

Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub's API and renders it without sanitization. On the client side, markdown is parsed with `marked` (with `sanitize: false`) and injected into the DOM via `$sce.trustAsHtml()` + `ng-bind-html`, bypassing AngularJS's built-in XSS protection. An attacker can craft a malicious GitHub repository whose README executes arbitrary JavaScript in the Anonymous GitHub origin.

### Details

#### README fetched from GitHub API

The server fetches the README via GitHub's REST API and stores the raw markdown in MongoDB:

```typescript
// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/src/core/source/GitHubRepository.ts#L162-L174
const ghRes = await oct.repos.getReadme({
  owner: this.owner,
  repo: this.repo,
  ref: selected?.commit,
});
const readme = Buffer.from(
  ghRes.data.content,
  ghRes.data.encoding as BufferEncoding
).toString("utf-8");
selected.readme = readme;
await model.save();
```

It is then served to the client with no sanitization:

```typescript
// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/src/server/routes/repository-private.ts#L254-L260
return res.send(
  await repo.readme({
    accessToken: token,
    force: req.query.force == "1",
    branch: req.query.branch as string,
  })
);
```

#### Client-side rendering via `$sce.trustAsHtml()` + `ng-bind-html`

The client fetches the raw README, parses it with `renderMD()` (which uses `marked` with `sanitize: false`), then bypasses AngularJS sanitization:

```javascript
// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/public/script/app.js#L1219-L1226
const res = await $http.get(`/api/repo/${o.owner}/${o.repo}/readme`, {
  params: { force: force === true ? "1" : "0", branch: $scope.source.branch },
});
$scope.readme = res.data;
```

```javascript
// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/public/script/app.js#L1339-L1343
const html = renderMD(
  $scope.anonymize_readme,
  `https://github.com/${o.owner}/${o.repo}/raw/${$scope.source.branch}/`
);
$scope.html_readme = $sce.trustAsHtml(html);  // sink: bypasses Angular XSS protection
```

The `renderMD()` function explicitly disables sanitization:

```javascript
// https://github.com/tdurieux/anonymous_github/blob/b2d77faa6c6f35ad9ae6ed46e3a3fa4681ac84c2/public/script/utils.js#L165-L176
marked.setOptions({
  sanitize: false,  // HTML in markdown is preserved as-is
  // ...
});
return marked.parse(md, { renderer });
```

The resulting HTML is bound to the DOM via `ng-bind-html`, which trusts the string marked by `$sce.trustAsHtml()` and inserts it as innerHTML.

### Impact

1. **Stored XSS**: Any malicious GitHub repository can execute JavaScript in the Anonymous GitHub origin when a user anonymizes it or views its content
2. **Account Takeover**: Steal authentication tokens and session cookies
3. **Data Exfiltration**: Access other users' anonymization configurations and private repository data via `/api/user` and `/api/repo/list`

### Proof of Concept

![poc-xss-anonymous-github](https://github.com/user-attachments/assets/c1bf3ed9-4e1e-4c8e-87f0-782a8d5f6ead)

1. Create a GitHub repository with a malicious `README.md`:

```markdown
# Innocent README
<img src=x onerror="alert(document.domain)">
```

2. On Anonymous GitHub, enter the malicious repository URL to anonymize it
3. The XSS executes immediately when the README preview is rendered on the anonymize page

### Remediation

1. Sanitize markdown output with DOMPurify before rendering (the dependency already exists but is unused)
2. Serve HTML files with `Content-Disposition: attachment` or in a sandboxed iframe on a separate origin
3. Replace `$sce.trustAsHtml()` with proper `ngSanitize` usage
4. HTML-escape filenames and paths in directory listing templates
5. Add Content Security Policy headers

### Credits

Zhengyu Liu, Jingcheng Yang

## Which versions are affected by GHSA-g485-8j3v-p6x8?

2 open source packages ship an affected version, including @tdurieux/anonymous_github.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `@tdurieux/anonymous_github` | npm | From 2.2.0 | 2.3.0 |
| `@tdurieux/anonymous_github` | npm | From 2.2.0 | 2.3.0 |

## How do I fix GHSA-g485-8j3v-p6x8?

Upgrade @tdurieux/anonymous_github to 2.3.0 or later.

## Is GHSA-g485-8j3v-p6x8 being exploited?

There is no known exploitation of GHSA-g485-8j3v-p6x8 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-g485-8j3v-p6x8 and fix it if it is affected.

What it is: GHSA-g485-8j3v-p6x8 is a cross-site scripting vulnerability in @tdurieux/anonymous_github, published on 5 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-g485-8j3v-p6x8 in the wild and no public exploit code.

Affected packages and fixed versions:
- @tdurieux/anonymous_github (npm): affected from 2.2.0; fixed in 2.3.0
- @tdurieux/anonymous_github (npm): affected from 2.2.0; fixed in 2.3.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-g485-8j3v-p6x8/ (Markdown: https://insights.sbomify.com/GHSA-g485-8j3v-p6x8/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-g485-8j3v-p6x8

---
From sbomify Insights: https://insights.sbomify.com/GHSA-g485-8j3v-p6x8/
Summaries are generated and may contain mistakes; the official description above is the record.