🎯 New Report #3988961: Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML
🔺Severity: High
👽 Reporter: timhaines
⭐️ Reputation: 367
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 3000
🕐 Submitted: 2026-09-01
⏰ Disclosed: 2026-10-14 08:12:57
📝 Summary: A stored cross-site scripting vulnerability was discovered in public dashboards where contributor-supplied data values were concatenated into markup without proper encoding. An attacker could register an account with a malicious script in the email address field, which would then execute in the browser sessions of users who interacted with the affected tooltip. The vulnerability was patched through multiple updates that disabled local signup, restored content security policies, and refactored the tooltip to use DOM nodes instead of string concatenation.
📂 Report JSON File: 3988961
@hackeronereports