Critical · published September 25, 2025
🚨 A crafty user could sneak JavaScript into the ticket comment editor of Horilla, opening the door for chaos in an admin's browser! 🔥 Think of it like a mischievous guest at a dinner party, slipping a note into the host's drink that, once consumed, makes the host spill secrets to everyone at the table — that's the sneaky power of stored XSS! With this vulnerability, a low-privilege user could hijack an admin session by exfiltrating critical cookies and CSRF tokens. Imagine an intruder eavesdropping on sensitive conversations and gaining full control — it could lead to unauthorized access to sensitive HR data and operations, a truly alarming scenario!
Think of it like a mischievous guest at a dinner party, slipping a note into the host's drink that, once consumed, makes the host spill secrets to everyone at the table — that's the sneaky power of stored XSS! The stored XSS vulnerability in Horilla's ticket comment editor allows an attacker to inject malicious JavaScript that executes in an admin’s browser, potentially leading to session hijacking.
With this vulnerability, a low-privilege user could hijack an admin session by exfiltrating critical cookies and CSRF tokens. Imagine an intruder eavesdropping on sensitive conversations and gaining full control — it could lead to unauthorized access to sensitive HR data and operations, a truly alarming scenario! Update Horilla to version 1.4.0 immediately to patch this vulnerability. Review user permissions and monitor any suspicious activity in your HRMS. Consider implementing additional security measures, such as Content Security Policy (CSP), to mitigate future risks. 🛡️ You've got this! Spend a little time on these steps and you'll have your systems secure in no time! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| horilla/horilla | < 1.4.0 | 1.4.0 |