Unsanitized API data rendered via innerHTML in character list items
low risk · medium confidence
Character details from the CHub API are placed directly into the page's HTML. If the API ever served malicious text, it could run unwanted scripts in the user's browser. The risk is low because it depends on the CHub API being compromised or serving hostile content.
Technical assessment
generateCharacterListItem interpolates character.name, character.description, character.tags, and character.author directly into an HTML template string that is assigned to characterListContainer.innerHTML via updateCharacterListInView. These fields originate from the CHub search API response (searchData.nodes) and are not sanitized or escaped. If the API response contained HTML or script tags, they would be rendered as DOM content, creating a potential stored-XSS vector. The same applies to the tag values rendered in span elements. This is a minor weakness because exploitation requires the CHub API to return hostile content, and no attacker-controlled input path to the API is demonstrated in the extension code.
Impact: low · Exploitability: unlikely
Developer action: Sanitize character name, description, tags, and author fields before inserting them into innerHTML, or use textContent / DOM construction instead of string interpolation into HTML.