[GH-ISSUE #2103] [bug]: XSS TRIGGERED #705

New issue

Closed

opened 2026-03-16 16:48:39 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 16:48:39 +03:00

Owner

Originally created by @krishnadevpmelevila on GitHub (Jan 31, 2022).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/2103

Is there an existing issue for this?

I have searched the existing issues

Current behavior

When I add <img src=x onerror=prompt(9)> on the profile page as profile name, It will trigger XSS.

Anyway, it is not a security issue as it is happening inside the user profile and no other user will affect it.But still, it is a bug.

Steps to reproduce

Login
Go to profile page
Enter name as <img src=x onerror=prompt(9)>
Refresh the page

Environment

Production

Version

Cloud

Originally created by @krishnadevpmelevila on GitHub (Jan 31, 2022). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/2103 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior When I add ```<img src=x onerror=prompt(9)>``` on the [profile page](https://hoppscotch.io/profile) as profile name, It will trigger XSS. ![image](https://user-images.githubusercontent.com/66047990/151747496-ea698a74-0dd8-44ce-ad47-02007a3656c0.png) ![image](https://user-images.githubusercontent.com/66047990/151747599-bdf0fb3c-0f6a-4b0a-8331-d5632562f45b.png) Anyway, it is not a security issue as it is happening inside the user profile and no other user will affect it.But still, it is a bug. ### Steps to reproduce 1. Login 2. Go to [profile page](https://hoppscotch.io/profile) 3. Enter name as ```<img src=x onerror=prompt(9)>``` 4. Refresh the page ### Environment Production ### Version Cloud

kerem

2026-03-16 16:48:39 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 16:48:55 +03:00

Author

Owner

@AndrewBastin commented on GitHub (Jan 31, 2022):

Thank you for the report @krishnadevpmelevila !

We have patched it in the latest build which should be live soon.

By the way seeing that you are a security researcher, for vulnerability disclosure it is the best to reach out to us over at support@hoppscotch.io so we can resolve this easily and quickly.

@AndrewBastin commented on GitHub (Jan 31, 2022): Thank you for the report @krishnadevpmelevila ! We have patched it in the latest build which should be live soon. By the way seeing that you are a security researcher, for vulnerability disclosure it is the best to reach out to us over at [support@hoppscotch.io](mailto:support.hoppscotch.io) so we can resolve this easily and quickly.

kerem commented

2026-03-16 16:49:00 +03:00

Author

Owner

@krishnadevpmelevila commented on GitHub (Jan 31, 2022):

Sure, Thank you for accepting my report, If I found any more bugs I will directly mail to the above-mentioned mail id

@krishnadevpmelevila commented on GitHub (Jan 31, 2022): Sure, Thank you for accepting my report, If I found any more bugs I will directly mail to the above-mentioned mail id

kerem referenced this issue

2026-03-17 00:28:39 +03:00

[PR #705] [MERGED] Updating the UI and style files #2802