Description

Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-30T13:17:33.537Z",
  "pubdate": "2026-09-30T13:17:33.537Z",
  "executiveSummary": "This vulnerability is an Unauthenticated Cross-Site Scripting (XSS) flaw identified in Parsi Date versions 6.3 and below.\nThe vulnerability allows an unauthenticated remote attacker to inject malicious client-side scripts into web pages viewed by other users.\nSuccessful exploitation compromises the integrity and confidentiality of the affected user's session within the web application.\nThe risk implication is significant as it facilitates session hijacking, unauthorized actions performed on behalf of the victim, and potential redirection to malicious external domains.\nExploitation requires no authentication and can be executed via a crafted URL or input vector handled by the vulnerable Parsi Date component.\nThis issue exposes users of the affected product to potential browser-based attacks, necessitating immediate remediation to maintain application security.",
  "technicalDetails": "The vulnerability resides in the improper handling of user-supplied input within the Parsi Date library, which fails to adequately sanitize or encode data before rendering it in the browser context.\nThis constitutes a Reflected or Stored XSS vulnerability depending on how the application integrates the Parsi Date component, allowing an attacker to inject arbitrary JavaScript payloads.\nThe root cause is the lack of context-aware output encoding. When the library processes date strings or related parameters containing malicious sequences, the application reflects these sequences directly into the Document Object Model (DOM) without neutralizing HTML tags or event handlers.\nAttack flow typically involves the attacker crafting a malicious payload, such as '<script>alert(document.cookie)</script>', and embedding it into a URL parameter or an input field processed by the Parsi Date library. Upon rendering, the browser interprets the input as executable code rather than plain text.\nBecause the vulnerability is unauthenticated, an attacker does not require valid credentials to initiate the exploit. The attack is network-exposed, meaning any user visiting a page utilizing the vulnerable library is susceptible to the payload.\nOnce the payload is executed in the context of the victim's browser, the attacker gains access to sensitive information stored in the browser, such as session cookies, local storage, and session tokens. Furthermore, the attacker can manipulate the DOM to alter the visual representation of the site, perform unauthorized HTTP requests, or exfiltrate data to a remote command-and-control server.\nAffected versions include all Parsi Date releases up to and including version 6.3. The vulnerability impacts any component or application that relies on this specific library for date-time rendering if the input source is not strictly validated prior to passing data to the Parsi Date functions.\nThe impact is significant as it bypasses standard security controls such as the Same-Origin Policy (SOP) by acting directly within the trusted application environment."
}