CVE-2026-63135

Received Received - Intake

Stored XSS in YOURLS Self-Hosted URL Shortener

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-63135

EUVD

EUVD-2026-64149

Affected Vendors & Products

Vendor	Product	Version / Range
yourls	yourls	to 1.10.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

YOURLS versions 1.5.1 to 1.10.3 store HTTP Referer headers in logs and statistics. The application concatenates these values into JavaScript without proper escaping, allowing an attacker to inject malicious JavaScript via a crafted Referer header. When users view statistics pages, the injected script executes in the YOURLS origin, potentially accessing sensitive data or performing privileged actions.

Detection Guidance

Check if your YOURLS version is between 1.5.1 and 1.10.3. Inspect HTTP Referer headers logged in yourls-infos.php or database for suspicious domains. Review JavaScript output in yourls-stats.php for unexpected inline script content.

Impact Analysis

An unauthenticated attacker could manipulate statistics pages to execute arbitrary JavaScript in the context of the YOURLS application. This could lead to theft of session tokens, API keys, or other sensitive data visible to administrators or users viewing public stats. Attackers might also perform unauthorized actions on behalf of users.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR principles of data protection and user consent. For HIPAA, it may expose protected health information if such data is processed by YOURLS. Organizations using affected versions risk non-compliance with data security requirements.

Mitigation Strategies

Upgrade YOURLS to version 1.10.4 or later immediately. Remove or sanitize stored Referer headers from logs and database. Disable public access to statistics pages if not required.

Hi! I’m here to help you understand CVE-2026-63135. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70