Potential cross-site scripting (XSS) vulnerability in Hydrogen

An attacker supplies malicious JavaScript within data that is used during client-side hydration of a Hydrogen page. When the application renders this user-controlled data, the script executes in the context of the victim's browser. The vulnerability is reachable over the network without authentication, as long as the application passes unsanitized user input into hydration data. The advisory notes that Content Security Policy is not an effective mitigation [patch_id=1641619].

The vulnerability exists in the client-side hydration mechanism of Hydrogen framework versions 0.10.0 through 0.18.0. The patch [patch_id=1641619] modifies the code path where hydration data is rendered into the DOM. The advisory does not specify exact file paths or function names.

The patch [patch_id=1641619] introduces sanitization or escaping of hydration data before it is injected into the page. By ensuring that user-controlled values are properly encoded, the framework prevents arbitrary script execution during the hydration process. This closes the XSS vector by treating all hydration data as untrusted and applying output encoding.