CVE-2024-38522

Name of the Vulnerable Software and Affected Versions Hush Line versions prior to 0.1.0

Description The Content Security Policy (CSP) applied on the tips.hushline.app website and bundled by default in the Hush Line repository is trivial to bypass. Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals.

Recommendations For versions prior to 0.1.0, update to version 0.1.0 to resolve the issue. As a temporary workaround, consider reviewing and reinforcing the CSP policy to minimize the risk of exploitation.