CVE-2026-68583
Received Received - Intake

Stored XSS in LuCI-app-adblock-fast for OpenWrt

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: VulnCheck

Description
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-68583
EUVD
EUVD-2026-51993

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

luci-app-adblock-fast before version 1.2.4-4 has a stored cross-site scripting (XSS) vulnerability in the blocklist name field. Lower-privileged users can inject active HTML into this field. When an administrator views the AdBlock Fast status page, the malicious payload executes in the administrator's browser within the LuCI application's origin.

Detection Guidance

This vulnerability involves stored cross-site scripting in the luci-app-adblock-fast blocklist name field. Detection requires checking for suspicious HTML or JavaScript payloads in blocklist names via the LuCI web interface or configuration files.

Impact Analysis

This vulnerability allows lower-privileged users to execute arbitrary scripts in the context of an administrator's browser session. This could lead to session hijacking, unauthorized actions performed by the admin, or theft of sensitive data displayed on the LuCI interface.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations if user data is exposed due to this XSS flaw.

Mitigation Strategies

Update luci-app-adblock-fast to version 1.2.4-4 or later. Review blocklist names for malicious payloads and remove any suspicious entries. Restrict lower-privileged user access to blocklist management.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart