CWE-79: Cross-Site Scripting

[omordyk]

Cross Site Scripting (XSS) vulnerability occurs when an application either does not perform or it performs incorrect neutralization (sanitization) of input data that is included in a web application response. As the result, an attacker is able to inject and execute arbitrary HTML and script code in a user's browser within the context of the vulnerable website. These attacks are often used to steal authentication credentials (e.g. session IDs in cookies). Depending on the vulnerability and the web application, it is also possible to completely alter the web page itself or control the victim's browser

A sensitive sink function was discovered in line 1167 of the file agreementbot/api.go. It causes a High severity Cross-Site Scripting vulnerability.