{"id":"CVE-2024-53272","summary":"GHSL-2024-109: Reflected XSS in /login in habitica","details":"Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.","modified":"2026-08-12T03:51:23.453414127Z","published":"2024-12-11T22:06:56.331Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53272.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53272.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53272"},{"type":"ADVISORY","url":"https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica/"},{"type":"FIX","url":"https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/habitrpg/habitica","events":[{"introduced":"0"},{"fixed":"50cc66d51cdcdd41f750bcb0c6fa7953fa540beb"},{"fixed":"946ade5da1f52a804ef2ba76d49416c43e8166bf"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:habitica:habitica:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.28.5"}]}}],"versions":["v5.28.4","v5.28.3","v5.28.2","v5.28.1","v5.28.0","v5.27.4","v5.27.3","v5.27.2","v5.27.1","v5.27.0","v5.26.3","v5.26.2","v5.26.0","v5.25.2","v5.25.1","v5.25.0","v5.24.2","v5.24.3","v5.24.1","v5.24.0","v5.23.0","v5.22.0","v5.22.3","v5.22.2","v5.22.1","v5.21.0","v5.20.0","v5.19.1","v5.19.0","v5.18.1","v5.18.0","v5.17.2","v5.17.1","v5.17.0","v5.16.1","v5.16.0","v5.15.2","v5.15.1","v5.15.0","v5.14.2","v5.14.1","v5.14.0","v5.12.2","v5.12.1","v5.3.0","v5.2.0","v5.1.4","v5.1.3","v5.1.2","v5.1.1","v5.1.0","v5.0.1","v5.0.0","v4.277.4","v4.277.3","v4.277.2","v4.277.1","v4.277.0","v4.276.2","v4.276.1","v4.276.0","v4.275.0","v4.273.0","v4.272.0","v4.271.2","v4.271.1","v4.270.1","v4.269.1","v4.269.0","v4.268.1","v4.268.0","v4.267.3","v4.267.0","v4.263.0","v4.262.2","v4.262.1","v4.262.0","v4.261.1","v4.260.1","v4.260.0","v4.259.1","v4.258.0","v4.249.6","v4.249.5","v4.245.1","v4.245.2","v4.245.0","v4.244.1","v4.244.0","v4.243.1","v4.243.0","v4.242.1","v4.241.0","v4.221.0","v4.217.0","v4.216.0","v4.215.1","v4.215.0","v4.214.6","v4.214.5","v4.213.0","v4.212.2","v4.212.1","v4.212.0","v4.211.8","v4.211.7","v4.211.6","v4.211.5","v4.211.4","v4.211.3","v4.210.1","v4.210.0","v4.209.0","v4.208.2","v4.202.0","v4.201.1","v4.201.0","v4.200.0","v4.199.1","v4.199.0","v4.198.2","v4.198.1","v4.198.0","v4.197.2","v4.197.1","v4.197.0","v4.196.1","v4.196.0","v4.195.0","v4.194.0","v4.193.0","v4.192.2","v4.192.1","v4.192.0","v4.191.0","v4.190.1","v4.190.0","v4.189.2","v4.189.1","v4.189.0","v4.188.4","v4.188.3","v4.188.2","v4.188.1","v4.188.0","v4.187.0","v4.186.0","v4.185.0","v4.184.3","v4.184.2","v4.184.1","v4.184.0","v4.183.1","v4.183.0","v4.182.0","v4.181.3","v4.181.2","v4.178.3","v4.178.2","v4.178.1","v4.178.0","v4.177.0","v4.176.0","v4.175.8","v4.175.7","v4.175.6","v4.175.5","v4.175.4","v4.175.3","v4.175.2","v4.175.1","v4.175.0","v4.167.0","v4.158.0","v4.157.1","v4.156.2","v4.156.1","v4.156.0","v4.155.2","v4.155.1","v4.154.1","v4.153.1","v4.152.1","v4.152.0","v4.151.5","v4.151.4","v4.151.3","v4.151.1","v4.151.0","v4.150.0","v4.149.3","v4.149.2","v4.149.1","v4.149.0","v4.148.3","v4.148.2","v4.148.1","v4.148.0","v4.147.3","v4.147.2","v4.146.6","v4.143.3","v4.143.2","v4.143.1","v4.143.0","v4.142.3","v4.142.2","v4.142.1","v4.142.0","v4.141.4","v4.141.3","v4.141.2","v4.141.1","v4.140.13","v4.140.12","v4.140.11","v4.140.10","v4.140.9","v4.140.4","v4.140.3","v4.140.2","v4.140.1","v4.140.0","v4.139.0","v4.138.6","v4.138.5","v4.138.4","v4.138.3","v4.138.2","v4.138.1","v4.136.3","v4.134.4","v4.134.3","v4.134.2","v4.134.1","v4.133.0","v4.132.2","v4.131.0","v4.130.2","v4.129.4","v4.129.2","v4.129.0","v4.129.1","v4.128.3","v4.128.2","v4.128.1","v4.128.0","v4.127.4","v4.127.3","v4.127.2","v4.127.1","v4.127.0","v4.126.1","v4.126.0","v4.125.0","v4.124.1","v4.124.0","v4.123.0","v4.122.0","v4.121.1","v4.121.0","v4.120.2","v4.120.1","v4.119.1","v4.119.0","v4.116.8","v4.116.7","v4.116.6","v4.116.5","v4.116.4","v4.116.1","v4.116.0","v4.115.2","v4.115.1","v4.115.0","v4.112.1","v4.110.2","v4.110.1","v4.107.1","v4.107.0","v4.106.2","v4.106.1","v4.105.4","v4.104.0","v4.103.1","v4.103.0","v4.102.0","v4.101.1","v4.101.0","v4.100.2","v4.100.1","v4.100.0","v4.99.1","v4.98.0","v4.97.0","v4.96.1","v4.96.0","v4.95.1","v4.94.1","v4.94.0","v4.93.4","v4.93.3","v4.93.2","v4.93.1","v4.93.0","v4.92.6","v4.92.5","v4.92.4","v4.92.3","v4.92.2","v4.92.1","v4.92.0","v4.91.1","v4.91.0","v4.90.4","v4.90.3","v4.90.2","v4.90.1","v4.89.0","v4.87.1","v4.87.0","v4.86.2","v4.86.1","v4.86.0","v4.85.5","v4.85.4","v4.84.6","v4.84.5","v4.84.4","v4.84.3","v4.84.2","v4.84.1","v4.84.0","v4.83.2","v4.83.1","v4.79.0","v4.80.0","v4.78.2","v4.77.5","v4.77.4","v4.77.3","v4.77.2","v4.77.1","v4.77.0","v4.76.1","v4.76.0","v4.75.5","v4.75.4","v4.75.3","v4.75.2","v4.75.1","v4.74.5","v4.74.4","v4.74.3","v4.74.2","v4.74.1","v4.74.0","v4.73.2","v4.73.1","v4.71.0","v4.70.0","v4.69.2","v4.67.0","v4.66.2","v4.65.6","v4.65.5","v4.65.3","v4.65.2","v4.65.1","v4.65.0","v4.64.2","v4.64.1","v4.64.0","v4.63.3","v4.63.2","v4.63.1","v4.63.0","v4.62.3","v4.62.2","v4.60.4","v4.60.2","v4.59.1","v4.58.0","v4.57.0","v4.56.3","v4.56.0","v4.55.1","v4.55.0","v4.54.0","v4.53.0","v4.52.2","v4.52.1","v4.52.0","v4.51.4","v4.51.3","v4.51.1","v4.49.0","v4.48.0","v4.46.2","v4.46.1","v4.46.0","v4.45.1","v4.44.2","v4.44.1","v4.43.0","v4.42.6","v4.42.5","v4.42.3","v4.42.2","v4.42.1","v4.41.5","v4.41.4","v4.41.3","v4.41.2","v4.41.1","v4.38.0","v4.37.1","v4.36.0","v4.35.1","v4.35.0","v4.34.2","v4.34.1","v4.34.0","v4.33.0","v4.32.1","v4.32.0","v4.31.1","v4.31.0","v4.29.0","v4.28.2","v4.28.1","v4.28.0","v4.26.0","v4.25.0","v4.24.6","v4.24.5","v4.24.4","v4.24.3","v4.24.2","v4.24.1","v4.24.0","v4.23.1","v4.23.0","v4.22.1","v4.22.0","v4.21.0","v4.20.3","v4.15.1","v4.15.0","v4.14.2","v4.12.5","v4.12.4","v4.11.1","v4.9.0","v4.4.3","v4.4.2","v4.4.1","v4.4.0","v4.3.0","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.4","v4.1.2","v4.1.1","v4.0.9","v4.0.8","v4.0.7","v4.0.5","v3.116.1","v3.116.0","v3.115.0","v3.114.1","v3.114.0","v3.113.2","v3.113.1","v3.113.0","v3.112.2","v3.112.1","v3.112.0","v3.111.6","v3.111.5","v3.111.4","v3.111.3","v3.111.2","v3.111.1","v3.111.0","v3.110.3","v3.110.1","v3.110.0","v3.109.0","v3.108.0","v3.107.1","v3.107.0","v3.106.1","v3.106.0","v3.83.0","v3.80.0","v3.79.2","v3.79.1","v3.79.0","v3.77.0","v3.76.0","v3.75.3","v3.75.2","v3.75.1","v3.75.0","v3.74.1","v3.74.0","v3.73.1","v3.73.0","v3.72.1","v3.72.0","v3.71.0","v3.70.0","v3.69.1","v3.69.0","v3.68.0","v3.67.1","v3.67.0","v3.66.3","v3.66.2","v3.66.1","v3.66.0","v3.65.2","v3.65.1","v3.65.0","v3.64.1","v3.64.0","v3.63.0","v3.62.0","v3.61.0","v3.60.0","v3.59.1","v3.59.0","v3.58.1","v3.58.0","v3.57.2","v3.57.1","v3.54.0","v3.57.0","v3.56.0","v3.55.0","v3.53.5","v3.53.4","v3.53.3","v3.53.2","v3.53.1","v3.53.0","v3.52.0","v3.51.1","v3.51.0","v3.50.0","v3.49.0","v3.48.0","v3.47.2","v3.47.1","v3.47.0","v3.46.2","v3.46.1","v3.46.0","v3.45.0","v3.44.5","v3.44.4","v3.44.3","v3.44.2","v3.44.1","v3.44.0","v3.43.2","v3.43.1","v3.43.0","v3.42.1","v3.41.4","v3.41.3","v3.41.2","v3.41.1","v3.41.0","v3.40.0","3.40.0","v3.39.1","v3.39.0","v3.29.0","v3.38.0","v3.36.1","v3.36.0","v3.35.0","v3.34.1","v3.34.0","v3.33.1","v3.33.0","v3.32.0","v3.31.0a","v3.31.0","v3.30.2","v3.30.1","v3.30.0","v3.29.1","v3.23.1","v3.23.0","v3.22.1","v3.22.0","v3.21.1","v3.21.0","v3.20.0","v3.19.0","v3.18.0","v3.17.0","v3.16.0","v3.15.0","v3.14.0","v3.13.0","v3.12.1","v3.12.0","v3.11.0","v3.10.0","v3.9.0","v3.8.1","v3.8.0","v3.7.3","v3.7.2","v3.7.1","v3.7.0","v3.6.1","v3.4.4","v3.6.0","v3.5.0","v3.4.3","v3.4.2","v3.4.1","v3.4.0","v3.3.3","v3.3.2","v3.3.1","v3.2.0","v3.1.2","v3.1.1","v3.0.2","v3.0.1","v3.0.0","3.0.0","2015-04-14-11-04-28","pre-i18n","v0.1.1","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53272.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:P"}]}