cve/2024/CVE-2024-38522.md

### [CVE-2024-38522](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38522)
![](https://img.shields.io/static/v1?label=Product&message=hushline&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%200.1.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-183%3A%20Permissive%20List%20of%20Allowed%20Inputs&color=brighgreen)

### Description

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.

### POC

#### Reference
- https://github.com/scidsg/hushline/security/advisories/GHSA-r85c-95x7-4h7q

#### Github
No PoCs found on GitHub currently.