Skip to content
OpenAdvisories

Vendor

HabitRPG

4 known vulnerabilities.

Products

habatica 3 habitica 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-54461

    Habitica: Regex Injection / ReDoS in Member Search

    Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenti…

    HabitRPG habitica
  • Medium 5.0
    CVE-2024-53273

    GHSL-2024-110: Reflected XSS in /register in habitica

    Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function.…

    HabitRPG habatica
  • Medium 5.0
    CVE-2024-53272

    GHSL-2024-109: Reflected XSS in /login in habitica

    Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sa…

    HabitRPG habatica