starred/github-profile-views-counter
1
0
Fork 0
mirror of https://github.com/antonkomarev/github-profile-views-counter.git synced 2026-07-13 17:21:51 -04:00
Code Issues 24 Packages Projects Releases Wiki Activity

XSS in label parameter #20

New Issue
Closed
opened 2025-11-20 04:15:08 -05:00 by saavagebueno · 2 comments
saavagebueno commented 2025-11-20 04:15:08 -05:00
Owner
Copy Link

Originally created by @arthurfiorette on GitHub (Apr 23, 2021).

Originally assigned to: @antonkomarev on GitHub.

I was creating my readme and i thought why not test if a script tag would work here? hahaha. It worked.

https://komarev.com/ghpvc/?username=arthurfiorette&style=flat-square&color=add8e6&label=%3Cscript%3Ealert(%27script%20with%20spaces!%27)%3C/script%3E

I haven't tested it much, but sometimes the server returns a 500 error, like when there is invalid html and so on. maybe it won't go anywhere, but it needs a check.

Originally created by @arthurfiorette on GitHub (Apr 23, 2021). Originally assigned to: @antonkomarev on GitHub. I was creating my readme and i thought why not test if a script tag would work here? hahaha. It worked. https://komarev.com/ghpvc/?username=arthurfiorette&style=flat-square&color=add8e6&label=%3Cscript%3Ealert(%27script%20with%20spaces!%27)%3C/script%3E I haven't tested it much, but sometimes the server returns a 500 error, like when there is invalid html and so on. maybe it won't go anywhere, but it needs a check.
saavagebueno added the bughelp wanted labels 2025-11-20 04:15:08 -05:00
saavagebueno commented 2025-11-20 04:15:08 -05:00
Author
Owner
Copy Link

@antonkomarev commented on GitHub (Apr 23, 2021):

Thank you for the report @ArthurFiorette!
This image not meant to be called directly from komarev.com domain. GitHub proxies all images, JS scripts are not working. You could try to place it to your readme and click preview button to make sure. However, it would be good to fix this problem.
PRs are welcome.

@antonkomarev commented on GitHub (Apr 23, 2021): Thank you for the report @ArthurFiorette! This image not meant to be called directly from komarev.com domain. GitHub proxies all images, JS scripts are not working. You could try to place it to your readme and click preview button to make sure. However, it would be good to fix this problem. PRs are welcome.
saavagebueno commented 2025-11-20 04:15:09 -05:00
Author
Owner
Copy Link

@antonkomarev commented on GitHub (Jun 1, 2021):

Resolved with #31 by @JaderH

@antonkomarev commented on GitHub (Jun 1, 2021): Resolved with #31 by @JaderH
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
help wanted
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
question
wontfix
No Label bug help wanted
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/github-profile-views-counter#20
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?