Slack · Report #11073
XSS in gist integration
Validstatus
$500bounty
157upvotes
28 Apr 2019disclosed
How it was found
- Create a gist called: "><svg onload=alert(1)>
- have gist integration enabled and put a link in a slack chat
- Visit the 'raw' or 'new window' pages for this gist, for example: https://outpost.slack.com/files/zemnmez/F029MDY33/___svg_onload_alert_1__