CVE-2026-55592

Received Received - Intake

JavaScript URL Injection in Dashy Dashboard

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: GitHub, Inc.

Description

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-55592

Affected Vendors & Products

Vendor	Product	Version / Range
dashy	dashy	to 4.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Dashy versions prior to 4.3.7, where the workspace view trusts the URL query parameter and assigns it directly to an iframe source without validating the URL scheme.

If a logged-in user opens a specially crafted workspace link containing a javascript: URL, the JavaScript code runs on the Dashy origin.

This allows the malicious script to read same-origin browser data, interact with the Dashy Document Object Model (DOM), and send requests as if it were the victim user.

Impact Analysis

The vulnerability can lead to unauthorized JavaScript execution within the Dashy application context.

This can result in an attacker reading sensitive browser data that shares the same origin, manipulating the Dashy interface, and performing actions on behalf of the victim user.

Such actions could compromise user data confidentiality and integrity, potentially leading to further exploitation or data leakage.

Mitigation Strategies

To mitigate this vulnerability, upgrade Dashy to version 4.3.7 or later, where the issue with trusting the url query parameter in the workspace view and assigning it directly to an iframe source without scheme validation has been fixed.

Hi! I’m here to help you understand CVE-2026-55592. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70