HTMLy v3.0.8 - Reflected Cross-Site Scripting (XSS) - CVE-2025-56154

- Security Advisory: Reflected Cross-Site Scripting (XSS) in HTMLy
- CVE ID: CVE-2025-56154

Summary
A Reflected Cross-Site Scripting (XSS) vulnerability was identified in HTMLy version v3.0.8. This vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser, leading to session hijacking or cookie theft.

Product Details
- Vendor: HTMLy
- Product: HTMLy
- Vulnerable Version: v3.0.8
- Fixed Version: v3.0.9

Vulnerability Details
- Vulnerability Type: Reflected Cross-Site Scripting (XSS)
- Discovery Date: 2025-06-06
- Researcher: Matan Sandori

Description
The vulnerability exists within the author profile endpoint (/author/:name). The application fails to properly sanitize user-supplied input before reflecting it back in the HTTP response.

An attacker can construct a malicious URL containing a JavaScript payload. If an administrator or authenticated user visits this URL, the payload executes.

Proof of Concept (PoC):

Reflected Cross-Site Scripting (XSS): URL Path / Username parameter Payload: "><img src=a onerror=alert(1)>

Raw URL:
/admin/users/admin"><img src=a onerror=alert(1)>/edit?destination=admin/users

URL Encoded:
/admin/users/admin%22%3E%3Cimg%20src%3da%20onerror%3dalert(1)%3E/edit?destination=admin/users

Screenshots/Proof: https://drive.google.com/drive/folders/18yOI_bbNWNK7iXyuzFJksXT1rXkz5y3r?usp=sharing

Timeline
- 2025-05-25: Initial security review of HTMLy v3.0.8.
- 2025-06-06: Reflected XSS vulnerability discovered and reported to MITRE (Ticket ID: MCI*********).
- 2025-07-05: Vendor released HTMLy v3.0.9, addressing the reported issues.

Credit
This vulnerability was discovered and reported by Matan Sandori.