HexBrain

Slack · Report #11073

XSS in gist integration

Validstatus
$500bounty
157upvotes
28 Apr 2019disclosed

How it was found

  1. Create a gist called: "><svg onload=alert(1)>
  2. have gist integration enabled and put a link in a slack chat
  3. Visit the 'raw' or 'new window' pages for this gist, for example: https://outpost.slack.com/files/zemnmez/F029MDY33/___svg_onload_alert_1__

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original