2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9520

CVE-2026-9520: Blitz has a Cross-site Scripting issue

A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9520

CVE-2026-9520:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
blitz	npm	<= 3.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a DOM-based Cross-Site Scripting (XSS) issue within the Blitz.js framework's sign-in functionality. The root cause is the improper handling of the next URL parameter, which is intended to redirect users after a successful login. The application code retrieves this parameter from the URL and passes it to the router.push() function without adequate validation or sanitization. An attacker can craft a malicious URL containing a javascript: payload in the next parameter. When a user clicks this link and successfully authenticates, the malicious JavaScript is executed in the context of the user's browser. This can lead to session hijacking, credential theft, or other unauthorized actions. The vulnerability is present in multiple template files generated by the framework for both the Pages Router and App Router implementations in Next.js, as detailed in the provided Gist.

Vulnerable functions

LoginForm

packages/generator/templates/app/src/app/auth/components/LoginForm.tsx

The `LoginForm` component retrieves the `next` parameter from the URL's query string using `useSearchParams`. This value is then used in a call to `router.push` for redirection after a successful login. Because the `next` parameter is not sanitized or validated, an attacker can provide a `javascript:` URI to execute arbitrary code in the user's browser, leading to a cross-site scripting (XSS) vulnerability.

Login

apps/toolkit-app/src/pages/login.tsx

The `onSuccess` handler within the `Login` page component retrieves the `next` parameter from the router's query. This parameter is then used to redirect the user via `router.push`. The lack of validation on the `next` parameter allows an attacker to inject a malicious `javascript:` URI, causing a cross-site scripting (XSS) vulnerability.

Login

apps/toolkit-app-passportjs/src/pages/auth/login.tsx

LoginPage

packages/generator/templates/pages/src/pages/auth/login.tsx

The `onSuccess` handler within the `LoginPage` component retrieves the `next` parameter from the router's query. This parameter is then used to redirect the user via `router.push`. The lack of validation on the `next` parameter allows an attacker to inject a malicious `javascript:` URI, causing a cross-site scripting (XSS) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.