medium6.4
CVE-2026-32774
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
Impact
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | vulnogram | <= 1.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vulnogram | Vulnogram | Version 1.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Vulnogram/Vulnogram
- https://github.com/Vulnogram/Vulnogram/security/advisories/GHSA-pg4p-2985-gvxr
- https://www.vulncheck.com/advisories/vulnogram-stored-cross-site-scripting-via-comment-hypertext
- https://github.com/Vulnogram/Vulnogram/commit/2f0e21b113c58124084c7b74c9768fc241126a05
- https://github.com/advisories/GHSA-vggc-6pg2-xvp9
- https://nvd.nist.gov/vuln/detail/CVE-2026-32774