Stored XSS in Ech0 RSS Feed via Unescaped Tag Names

Executive Summary

CVE-2026-79663 is a stored cross-site scripting (XSS) vulnerability in the Ech0 application before version 4.7.3. It affects the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious JavaScript code through tag names or raw HTML in echo content. This script executes in RSS readers that render HTML-type summaries, impacting all subscribers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the RSS feed output of your Ech0 instance for unescaped HTML tags or JavaScript code in tag names or markdown content. Check if raw HTML is rendered in the feed by viewing the feed source in a browser or using command-line tools like curl to fetch the RSS feed URL and examine its contents for suspicious scripts or HTML tags.

Useful 0 Not Useful 0

Impact Analysis

If you are an admin, an attacker could exploit this to inject malicious scripts into the RSS feed. For subscribers, the injected script executes when viewing the feed, potentially leading to unauthorized data access, cross-feed data theft, or phishing attacks disguised as legitimate feed entries. Anonymous users and other admins are also at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA compliance requirements. Unauthorized data access or theft could result in legal penalties, reputational damage, and loss of trust. Organizations must address this flaw to maintain compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ech0 to version 4.7.3 or later to address the vulnerability. Additionally, implement HTML escaping for tag names before rendering and enable the html.SkipHTML flag in the markdown renderer to strip raw HTML. Validate tag names at creation time to reject HTML metacharacters.

Useful 0 Not Useful 0