Description
Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | < 4.5.1 | 4.5.1 |
References
- GitHub Security Advisory (GHSA-m649-gvwx-j6qv) vendor-advisory
- VulnCheck Advisory: Zipline before 4.5.1 Stored XSS via HighlightCode Component third-party-advisory