CVE-2026-104816

Deferred Deferred - Pending Action

RSS Feed Link XSS in Misskey

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104816

EUVD

EUVD-2026-99238

Affected Vendors & Products

Vendor	Product	Version / Range
misskey-dev	misskey	>= 12.0.0, <= 13.14.2
misskey-dev	misskey	>= 2023.9.0-beta.1, < 2026.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects Misskey, a federated social media platform, between versions 12.0.0 and 2026.7.0. It involves RSS feed components displaying links without verifying URL schemes. Attackers can exploit this by providing unsafe links in feed content, causing script execution when users click them in an RSS widget.

Detection Guidance

To detect this vulnerability, check if your Misskey instance is running a version between 12.0.0 and 2026.7.0. Use the command: curl -s https://your-misskey-instance.com/api/meta | grep version. If the version is below 2026.7.0, the system is vulnerable.

Impact Analysis

If you use Misskey with vulnerable versions, clicking a malicious link in an RSS widget could execute arbitrary scripts in your browser. This may lead to account compromise, data theft, or unauthorized actions on your behalf. Users should avoid clicking links in RSS widgets from untrusted sources.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk exposure of protected health information if exploited in healthcare-related Misskey instances. Compliance could be impacted if user data is compromised due to this flaw.

Mitigation Strategies

Upgrade to Misskey version 2026.7.0 or later immediately. This version includes URL validation in RSS widgets to prevent XSS attacks. No temporary workarounds are available.

Hi! I’m here to help you understand CVE-2026-104816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70