CVE-2020-7741

CVE-2020-7741 is a critical Cross-Site Scripting (XSS) vulnerability affecting versions of the hello.js package prior to 1.18.6. The vulnerability arises from the application's failure to properly sanitize the oauth_redirect URL parameter before passing it to location.assign, allowing attackers to inject malicious JavaScript. With a CVSS score of 9.9 (CRITICAL), this flaw is easily exploitable over the network with low attack complexity, potentially leading to significant impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE.