CVE-2026-91146

Deferred Deferred - Pending Action

JavaScript URL Injection in Takahe Federated Content

Publication date: 2026-09-14

Last updated on: 2026-09-23

Assigner: VulnCheck

Description

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, enabling session hijacking or impersonation of viewers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-23

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-91146

EUVD

EUVD-2026-78169

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Takahe through version 0.11.0 does not properly restrict URL schemes in link href attributes within federated post content and profile summaries. This allows attackers to inject javascript: links that execute when clicked, running in the context of the instance origin.

Detection Guidance

To detect this vulnerability, inspect federated post content and profile summaries in Takahe for javascript: links in href attributes. Check server logs for unusual activity after users interact with federated content. No specific commands are provided in the context.

Impact Analysis

An attacker could send federated content with malicious javascript: links. When viewed, these links could execute arbitrary JavaScript in the user's browser, potentially stealing session cookies, performing actions on behalf of the user, or impersonating the user to other viewers.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating confidentiality requirements under GDPR and HIPAA. It may also result in data breaches, triggering mandatory breach notification obligations under these regulations.

Mitigation Strategies

Update Takahe to the latest version beyond 0.11.0. Implement input validation to block javascript: URLs in href attributes. Review and sanitize federated content before rendering. Monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-91146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70