Hide Files on GitHub options.js addEventListener cross site scripting

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Hide Files on GitHub browser extension, affecting versions up to 2.x. The flaw is located in the addEventListener function within the file extension/options.js. The manipulation of input leads to potential code injection, allowing execution of arbitrary HTML and script code in the context of the extension's options page. The issue arises from insufficient sanitization of user-supplied input, specifically in how the extension handles regular expression patterns entered by the user [1][2].

Exploitation

The attack can be initiated remotely, but requires some level of user interaction. An attacker would need to convince a victim to visit a specially crafted page or inject a malicious script that interacts with the extension's options page. The vulnerability is classified as a self-XSS, meaning the attacker cannot directly inject into another user's session without some form of social engineering or local access. However, if the victim is tricked into copying and pasting malicious input into the extension's settings, the injected script would run in the context of the extension's privileged options page [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the Hide Files on GitHub extension, potentially gaining access to the extension's storage, performing actions on behalf of the user on GitHub, or extracting sensitive data such as API tokens or repository filters. The privacy of user settings and HTTP communications could be compromised if the attacker exfiltrates stored data [1][2].

Mitigation

The vulnerability was addressed in version 3.0.0 of the extension, released alongside an associated commit (9de0c57) that implements HTML escaping via an inline version of the escape-goat package. Users are strongly recommended to upgrade to version 3.0.0 or later. No workarounds are provided for earlier versions, and the repository has since been archived as read-only. There is no indication that this CVE is on the KEV list [1][2][3].