CVE-2026-79663
4.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Summary
Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| lin-snow | Ech0 | 0 < 4.7.3 | affected |
| lin-snow | Ech0 | 4.7.3 | unaffected |
Weaknesses
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/lin-snow/Ech0/security/advisories/GHSA-3v85-fqvh-7rxf
- https://www.vulncheck.com/advisories/ech0-before-stored-xss-via-rss-feed-tag-names
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.