What’s Vulnerable › Vulnerabilities

CVE-2022-24864: Malicious Javascript injection in OriginProtocol/origin-website

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-20 · updated 2026-06-17
• Weakness: CWE-79

Description

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to `/presale/join`. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the founders@originprotocol.com. If the email recipient is using an email program that is susceptible to XSS, then that email recipient will receive an email that may contain malicious XSS. Regardless if the email recipient’s mail program has vulnerabilities or not, the hacker can at the very least inject malicious HTML that modifies the body content of the email. There are currently no known workarounds.

Affected products

• OriginProtocol origin-website: before 2022-01-10 — fixed in 2022-01-10

How to fix

Upgrade to a fixed version: OriginProtocol origin-website 2022-01-10. Check the vendor advisory for mitigations.

References

• https://github.com/OriginProtocol/origin-website/pull/617
• https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7
• https://github.com/github/codeql/pull/7127
• https://github.com/OriginProtocol/origin-website/pull/617
• https://github.com/OriginProtocol/origin-website/security/advisories/GHSA-v6fc-qwxx-m4h7
• https://github.com/github/codeql/pull/7127

Get alerted when CVE-2022-24864 or the next vulnerability affects your stack