Skip to content

Vendor

blitz-js vulnerabilities

2 published CVES affecting blitz-js, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of blitz-js alerts

Products

Latest blitz-js CVEs

Newest publication first

  1. CVE-2026-9520 blitz-js blitz Sign-in LoginForm.tsx cross site scripting

    Published
    MediumCVSS 5.3 EPSS 0.34%

    A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting...

  2. CVE-2022-23631 Prototype Pollution leading to Remote Code Execution in superjson

    Published
    CriticalCVSS 9.8 EPSS 2.7%

    superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.