{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.0.2"}],"component":"blitz","cve_ids":["CVE-2026-9520"],"ecosystem":"npm","epss":0.00449,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-h2p9-cr4h-px24","id":"tcs_01M5KFSWNGDFJ9AC5F294ZR513","modified_at":"2026-06-30T17:56:29.939459Z","published_at":"2026-05-26T13:30:53Z","references":["https://osv.dev/vulnerability/GHSA-h2p9-cr4h-px24","https://nvd.nist.gov/vuln/detail/CVE-2026-9520","https://gist.github.com/TrebledJ/164c7ca6c8208b63e6937bc11984720b","https://github.com/blitz-js/blitz","https://vuldb.com/submit/814378","https://vuldb.com/vuln/365540","https://vuldb.com/vuln/365540/cti"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-h2p9-cr4h-px24","url":"https://osv.dev/vulnerability/GHSA-h2p9-cr4h-px24"}],"summary":"Blitz has a Cross-site Scripting issue"}