CVE-2026-54443

5.9 Moyenne

Publiée le 15/07/2026 à 21:17 · Modifiée le 15/07/2026 à 22:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.

Traduire en français

Produits concernés

lissy93 dashy

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.9 Moyenne	security-advisories@github.com	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-80
CWE-84

Références

https://github.com/lissy93/dashy/releases/tag/3.2.0
https://github.com/lissy93/dashy/security/advisories/GHSA-2x3v-qmgm-r8hv
https://github.com/lissy93/dashy/security/advisories/GHSA-2x3v-qmgm-r8hv

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories