https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T13:56:28.103348+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-57368 EUVD-2026-57368 2026-10-08T13:56:28.163289+00:00 EUVD-2026-57368 https://cve.radiocsirt.org/vuln/fkie_cve-2019-15782 fkie_cve-2019-15782 2026-10-08T13:56:28.163327+00:00

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.

 https://cve.radiocsirt.org/vuln/ghsa-gjh4-fcv3-whpq GHSA-gjh4-fcv3-whpq — Cross-Site Scripting in webtorrent 2026-10-08T13:56:28.163360+00:00

Affected: npm: webtorrent

Versions of `webtorrent` prior to 0.107.6 are vulnerable to Cross-Site Scripting. `webtorrent` servers started with `torrent.createServer()` lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent.

## Recommendation

Upgrade to version 0.107.6 or later.

 https://cve.radiocsirt.org/vuln/gsd-2019-15782 gsd-2019-15782 2026-10-08T13:56:28.163389+00:00 gsd-2019-15782