Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Misskey RSS feed links can run malicious code

CVE-2026-104816 · published today
Summary

The Misskey social platform’s RSS widget shows links from feeds without checking the type of link. If an attacker supplies a specially crafted link, clicking it can cause unwanted script to run in the user’s browser. Upgrade to version 2026.7.0 or later to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
misskey-dev misskey >= 12.0.0, <= 13.14.2
Original advisory text
Misskey: Cross-site scripting in RSS feed item links
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Oct 2026
Updated14 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-104816 · NVD
CVE-2026-104816 · MITRE
CVE-2026-104816 · OSV
GHSA-p73x-6qrq-34jc · GHSA
Track software like this
Free during beta