GHSA-h2p9-cr4h-px24

Blitz has a Cross-site Scripting issue

Source: GitHub Advisory Database (reviewed) Low CVE-2026-9520

Packages

Ecosystem	Package	Affected	Fixed in
npm	blitz	<= 3.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-9520 advisory
https://gist.github.com/TrebledJ/164c7ca6c8208b63e6937bc11984720b web
https://github.com/blitz-js/blitz package
https://vuldb.com/submit/814378 web
https://vuldb.com/vuln/365540 web
https://vuldb.com/vuln/365540/cti web