LinuxServer.io Heimdall Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in LinuxServer.io Heimdall versions prior to 2.7.3. The issue arises in the search functionality, where the 'q' parameter is not properly sanitized, allowing for the injection of malicious scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the Heimdall application with a crafted 'q' parameter that includes JavaScript code. The application will execute the injected script in the user's browser, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to Heimdall version 2.7.3 or later, where this vulnerability has been addressed.