https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:41:29.612085+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-211225 EUVD-2026-211225 2026-10-04T11:41:29.689049+00:00 EUVD-2026-211225 https://cve.radiocsirt.org/vuln/fkie_cve-2021-46888 fkie_cve-2021-46888 2026-10-04T11:41:29.689084+00:00

An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

 https://cve.radiocsirt.org/vuln/ghsa-9fcq-h23h-rxhx GHSA-9fcq-h23h-rxhx 2026-10-04T11:41:29.689117+00:00

An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

 https://cve.radiocsirt.org/vuln/gsd-2021-46888 gsd-2021-46888 2026-10-04T11:41:29.689134+00:00 gsd-2021-46888 https://cve.radiocsirt.org/vuln/hsec-2023-0008 HSEC-2023-0008 — Stored XSS in hledger-web 2026-10-04T11:41:29.689146+00:00

Affected: Hackage: hledger-web

# Stored XSS in *hledger-web*

An issue was discovered in *hledger-web* < 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in `toBloodhoundJson` that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the `atob` function.

*hledger-web* forms sanitise obvious JavaScript, but not obfuscated JavaScript (see [OWASP Filter Evasion Cheat Sheet][cheatsheet]). This means *hledger-web* instances, especially anonymously-writable ones like `demo.hledger.org`, could be loaded with malicious JavaScript to be executed by subsequent visitors.

[cheatsheet]: https://owasp.org/www-community/xss-filter-evasion-cheatsheet

Reported by Gaspard Baye and Hamidullah Muslih. Fix by Arsen Arsenović.