repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard

Description

The RepoCard component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React’s dangerouslySetInnerHTML to render the repository name (repo prop) during the loading state without any sanitization.

Recommendation

Update the repostat package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.1
• Patched version(s): 1.0.1

References

• GHSA-fm8c-6m29-rp6j
• CVE-2026-27612
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6