Skip to content
OpenAdvisories
Medium · 6.3 CVE-2024-38522 EUVD-2024-37391

CSP bypass in Hush Line

Published Jun 28, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Description

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.

Affected products

VendorProductAffectedFixed
scidsg hushline < 0.1.0 —

References