Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-3951 is a reflected Cross-Site Scripting (XSS) vulnerability in LockerProject Locker versions 0.0.0, 0.0.1, and 0.1.0. It affects the function authIsAwesome in the file registry.js, part of the Error Response Handler component. The vulnerability occurs because the id parameter from user input is directly concatenated into an HTTP error response without any sanitization or encoding. This allows an attacker to inject arbitrary JavaScript code that is executed in the victim's browser when the crafted URL is accessed."}, {'type': 'paragraph', 'content': "The attack can be launched remotely and does not require authentication, but it requires some user interaction to trigger the malicious script. A proof-of-concept exploit uses a specially crafted SVG payload that triggers an alert in the victim's browser, confirming the vulnerability."}] [1, 3, 4]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability allows remote attackers to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to several impacts including session hijacking, defacement of web pages, theft of sensitive information, or performing actions on behalf of the user without their consent."}, {'type': 'paragraph', 'content': 'Because the vulnerability is reflected XSS, it requires the victim to interact with a crafted URL or link. The exploit is publicly available, increasing the risk of attacks. The vulnerability impacts data integrity and can compromise user trust and security.'}] [1, 3, 4]

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by sending specially crafted HTTP requests to the vulnerable LockerProject Locker endpoint that includes the `id` parameter in the URL path. If the server response reflects the injected payload verbatim without sanitization, it confirms the presence of the reflected XSS vulnerability.'}, {'type': 'paragraph', 'content': 'A proof-of-concept uses a payload such as `<SvG oNlOAD=alert("zast-xss")>` inserted as the `id` parameter in the URL path. When the server responds with this payload reflected in the HTTP response body, it indicates the vulnerability.'}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -i "http://[target]/[vulnerable_path]/<SvG oNlOAD=alert(\\"zast-xss\\")>"'}, {'type': 'paragraph', 'content': 'If the response body contains the payload string without encoding or sanitization, the system is vulnerable.'}, {'type': 'paragraph', 'content': 'Additionally, a Python script using the requests library can be used to automate this test by sending a GET request with the crafted payload and checking the response for the reflected payload.'}] [3, 4, 1]

Useful 0 Not Useful 0

Mitigation Strategies

Currently, no official countermeasures or patches have been published by the LockerProject maintainers, and the project has not responded to the issue report.

Immediate mitigation steps include:

• Avoid using the affected versions (0.0.0, 0.0.1, 0.1.0) of LockerProject Locker.
• Consider replacing the affected component with an alternative product that does not have this vulnerability.
• Implement web application firewall (WAF) rules to detect and block requests containing suspicious payloads targeting the `id` parameter.
• If possible, apply input validation and sanitization on the server side to neutralize the `id` parameter before it is reflected in responses.

Monitoring for exploit attempts and restricting access to the vulnerable endpoints can also reduce risk until a proper fix is available.

Useful 0 Not Useful 0