Eriner

A reflected cross-site scripting (XSS) issue exists on the '/api/auth/error' endpoint. The application reflects the value of the `error` URL parameter as HTML without proper neutralization, allowing an attacker to execute arbitrary JavaScript in the user's browser by inducing them to visit a specially-crafted URL.

Name of the Vulnerable Software and Affected Versions: Home Assistant Community Add-on: SSH & Web Terminal versions prior to 10.0.0 Description: The addon.stdin service has an attack surface that requires social engineering. Although the vendor does not agree that this is a vulnerability, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations. Recommendations: For versions prior to 10.0.0, consider removing or disabling the addon.stdin service as a defense-in-depth measure against complex social engineering situations.

The issue allows authenticated Argo users to submit API calls to retrieve secrets and other manifests stored within git.