Critical Webhook XSS Vulnerability (GHSA-v73-3mwr6-fgcm)

A critical Same-Origin Cross-Site Scripting (XSS) vulnerability has been identified in the “Respond to Webhook” node. This flaw allows attackers to inject malicious scripts executed within the application’s trusted origin, leading to session hijacking and data theft.

Technical Mechanics of the Webhook XSS Flaw

The vulnerability occurs when webhook payload data is not properly sanitized or escaped before being reflected in the HTTP response. Because the response originates from the application’s domain, the browser executes embedded JavaScript within the victim’s session context. This bypasses CORS protections and grants access to document.cookie, localStorage, and the DOM.

Attack Impact and Risk Scenarios

• Credential Theft: Keylogging or phishing overlays in login forms.
• UI Defacement: Manipulation of dashboards to hide malicious activity.
• Supply Chain Risk: Vulnerabilities spread via compromised third-party vendors.

Defense-in-Depth Strategy

• Strict Input Validation: Use allow-lists for webhook payloads.
• Context-Aware Output Encoding: Apply HTML, JavaScript, URL, and CSS encoding.
• Correct Content-Type Headers: Always return application/json.
• Content Security Policy (CSP): Enforce script-src 'self' and avoid 'unsafe-inline'.
• Cookie Hardening: Use HttpOnly and Secure flags.

Tools and Libraries for XSS Prevention

• DOMPurify: Trusted HTML sanitizer.
• OWASP Java Encoder: Context-aware encoding library.
• OWASP ZAP & Burp Suite: DAST scanners for webhook endpoints.

Conclusion

Same-Origin XSS in webhook handlers is a severe security risk. GHSA-v73-3mwr6-fgcm demonstrates how insufficient output encoding can turn a simple integration feature into a session hijacking vector. Organizations must audit every webhook endpoint, enforce strict input validation, apply correct Content-Type headers, and deploy CSP to prevent exploitation.