GHSA-9jmq-xgjm-p8c2Medium

Sync-in Server has a stored cross-site scripting (XSS) vulnerability

Published
February 20, 2026
Last Modified
February 20, 2026

🔗 CVE IDs covered (1)

CVE-2025-67438 →

📋 Description

A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate sensitive information, including the user's session cookies.

🎯 Affected products1

  • npm/@sync-in/server:< 1.9.3

🔗 References (5)