The vulnerability stems from the RepoCard component rendering the repository name through React's dangerouslySetInnerHTML during its loading state. Because the component does not sanitize the repo prop, an attacker can supply arbitrary HTML or JavaScript, such as via a URL query parameter, that will be executed in the context of any user who loads the page. This allows an attacker to steal session cookies, hijack user sessions, or otherwise compromise the integrity and confidentiality of the client’s browser session. The weakness is a classic reflected cross‑site scripting flaw noted as CWE‑79. The impact is strictly client‑side and does not affect the server or the underlying GitHub data.

The software affected is denpiligrim repostat. Any usage of the RepoCard component in versions prior to 1.0.1 is vulnerable. The component’s vulnerability is tied specifically to the handling of the repo prop. All installations of repostat that pull older versions, whether from npm, yarn, or direct repository, are at risk until they upgrade to v1.0.1 or later.

The CVSS score of 6.1 classifies the issue as moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The most likely exploitation scenario involves a malicious link that includes a crafted repo query parameter; a user clicking the link would trigger the XSS payload. No elevated privileges are required, but the attacker must convince a user to visit the crafted URL. The affected scope is limited to the affected client’s browser session, but the consequences can be severe if the page holds sensitive information or authentication cookies.