In reply to @v12sec

V12

@v12sec · Twitter · 2026-09-02 19:22 UTC

Ditto tries to sanitize <PATH> by escaping `'` before passing into JavaScript. But it does not escape backslashes. A path containing `\'` becomes `\\'`: an escaped backslash followed by a live quote. The string ends. Attacker-controlled JavaScript begins.