CVE-2020-7741: Hello.js Project Hello.js

Critical severity, CVSS 9.9. EPSS: 1.5% chance of exploitation in the next 30 days.

This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).

Affected products

• Hello.js Project Hello.js: before 1.18.6 (fixed in 1.18.6)

Published 2020-10-06. Last modified 2026-06-17.