AIKIDO-2026-453268

blazer is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-m5f6-4589-m89f Published 5 days ago

Medium Risk

This Affects:

blazer

1.7.3 - 3.4.0

Fixed in 3.5.0

Are you affected? Scan for Free

TL;DR

Blazer renders user-created query content in its web UI for review and editing. An authenticated user can save a query containing crafted input that is stored and later rendered without proper output encoding when another user opens that query to edit it. The unescaped content executes arbitrary JavaScript in the victim's browser, allowing actions to be performed as that user against resources on the same origin. The fix renders the affected values through default template escaping so stored input is neutralized.

Who does this affect?

You are affected if you run a multi-user Blazer instance on a version in the vulnerable range where users can create or save queries and other users open those queries in the editor. Query content saved by one (potentially lower-privileged or untrusted) user is rendered without output encoding when a different user edits that query, so the stored JavaScript runs in the editing user's browser on the same origin. Single-user deployments, or instances where query authoring is restricted to fully trusted operators, have limited exposure.