CVE-2026-55592

3.9 Faible

Publiée le 07/07/2026 à 23:17 · Modifiée le 08/07/2026 à 17:28 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.

Traduire en français

Produits concernés

lissy93 dashy

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.9 Faible	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b
https://github.com/lissy93/dashy/releases/tag/4.3.7
https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc
https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories