GHSA-9jmq-xgjm-p8c2
NoneCVSS
—
EPSS
—
Published
Feb 20, 2026
CISA due date
—
The record
Sync-in Server has a stored cross-site scripting (XSS) vulnerability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @sync-in/server | 0 | 1.9.3 |
Related vulnerabilities
- CVE-2025-67438 A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows… Same vulnerability
- CVE-2026-47684 Sync-in Server is a secure, open-source platform for file storage, sharing… Also affects @sync-in/server
- GHSA-q4x5-8cj6-52wg Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP Also affects @sync-in/server
- CVE-2026-41161 Sync-in Server is a secure, open-source platform for file storage, sharing… Also affects @sync-in/server
- GHSA-43fj-qp3h-hrh5 Sync-in Server has Username Enumeration via Timing Attack Also affects @sync-in/server
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79