{"id":"CVE-2026-104816","summary":"Misskey: Cross-site scripting in RSS feed item links","details":"Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.","aliases":["GHSA-p73x-6qrq-34jc"],"modified":"2026-10-14T10:46:14.817048565Z","published":"2026-10-13T18:38:06.905Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104816.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104816.json"},{"type":"FIX","url":"https://github.com/misskey-dev/misskey/commit/8dd59a8c06da49b8f302d902d73d04397ee29366"},{"type":"FIX","url":"https://github.com/misskey-dev/misskey/pull/17831"},{"type":"WEB","url":"https://github.com/misskey-dev/misskey/releases/tag/2026.7.0"},{"type":"ADVISORY","url":"https://github.com/misskey-dev/misskey/security/advisories/GHSA-p73x-6qrq-34jc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104816"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/misskey-dev/misskey","events":[{"introduced":"781cebf19406c9db4c769f35a78c991326393b98"},{"last_affected":"a8d45d4b0d24e0c422d4e6d8feab57035239db56"},{"introduced":"2939e8131d303f27ef24541fa8394369401be08b"},{"fixed":"8ea4a0ecac058688f69706ab88de1fcd439e2621"}],"database_specific":{"extracted_events":[{"introduced":"12.0.0"},{"last_affected":"13.14.2"},{"introduced":"2023.9.0-beta.1"},{"fixed":"2026.7.0"}],"source":"AFFECTED_FIELD"}}],"versions":["2026.7.0-rc.0","2026.7.0-beta.6","2026.7.0-beta.3","2026.7.0-beta.2","2026.7.0-beta.1","2026.7.0-beta.0","2026.7.0-alpha.5","2026.7.0-alpha.4","2026.7.0-alpha.3","2026.7.0-alpha.2","2026.7.0-alpha.1","2026.7.0-alpha.0","2026.6.1-alpha.1","2026.6.0-beta.1","2026.6.0-beta.0","2026.6.0-alpha.2","2026.6.0-alpha.1","2026.6.0-alpha.0","2026.5.4","2026.5.4-beta.0","2026.5.4-alpha.0","2026.5.3","2026.5.3-alpha.0","2026.5.2","2026.5.2-beta.1","2026.5.2-beta.0","2026.5.2-alpha.0","2026.5.1","2026.5.1-beta.0","2026.5.1-alpha.0","2026.5.0","2026.5.0-alpha.0","2026.4.0-beta.2","2026.4.0-beta.1","2026.4.0-beta.0","2026.4.0-alpha.6","2026.4.0-alpha.5","2026.4.0-alpha.4","2026.4.0-alpha.3","2026.4.0-alpha.2","2026.4.0-alpha.1","2026.4.0-alpha.0","2026.3.2","2026.3.2-beta.0","2026.3.2-alpha.2","2026.3.2-alpha.1","2026.3.2-alpha.0","2026.3.1","2026.3.1-alpha.0","2026.3.0","2026.3.0-alpha.0","2026.2.0-beta.0","2026.2.0-alpha.0","2026.1.0-beta.0","2026.1.0-alpha.4","2026.1.0-alpha.3","2026.1.0-alpha.2","2026.1.0-alpha.1","2026.1.0-alpha.0","2025.12.2","2025.12.2-beta.4","2025.12.2-beta.3","2025.12.2-beta.2","2025.12.2-alpha.0","2025.12.1","2025.12.1-alpha.1","2025.12.1-alpha.0","2025.12.0","2025.12.0-beta.0","2025.12.0-alpha.2","2025.12.0-alpha.1","2025.12.0-alpha.0","2025.11.2-alpha.4","2025.11.2-alpha.3","2025.11.2-alpha.2","2025.11.2-alpha.1","2025.11.2-alpha.0","2025.11.1","2025.11.1-beta.3","2025.11.1-beta.2","2025.11.1-beta.1","2025.11.1-beta.0","2025.11.1-alpha.2","2025.11.1-alpha.1","2025.11.1-alpha.0","2025.11.0","2025.11.0-rc.0","2025.11.0-beta.0","2025.11.0-alpha.4","2025.11.0-alpha.3","2025.11.0-alpha.2","2025.11.0-alpha.1","2025.11.0-alpha.0","2025.10.2","2025.10.2-beta.0","2025.10.2-alpha.0","2025.10.1","2025.10.1-beta.4","2025.10.1-beta.2","2025.10.1-beta.1","2025.10.1-beta.0","2025.10.1-alpha.6","2025.10.1-alpha.5","2025.10.1-alpha.4","2025.10.1-alpha.2","2025.10.1-alpha.1","2025.10.1-alpha.0","2025.10.0","2025.10.0-beta.2","2025.10.0-beta.1","2025.10.0-beta.0","2025.10.0-alpha.0","2025.9.1-alpha.2","2025.9.1-alpha.1","2025.9.1-alpha.0","2025.9.0","2025.9.0-rc.0","2025.9.0-beta.1","2025.9.0-beta.0","2025.9.0-alpha.2","2025.9.0-alpha.1","2025.9.0-alpha.0","2025.8.0","2025.8.0-rc.0","2025.8.0-beta.6","2025.8.0-beta.5","2025.8.0-beta.4","2025.8.0-beta.3","2025.8.0-beta.2","2025.8.0-beta.1","2025.8.0-beta.0","2025.8.0-alpha.13","2025.8.0-alpha.12","2025.8.0-alpha.11","2025.8.0-alpha.9","2025.8.0-alpha.8","2025.8.0-alpha.7","2025.8.0-alpha.6","2025.8.0-alpha.5","2025.8.0-alpha.4","2025.8.0-alpha.3","2025.8.0-alpha.2","2025.8.0-alpha.1","2025.8.0-alpha.0","2025.7.0","2025.7.0-rc.1","2025.7.0-rc.0","2025.7.0-beta.2","2025.7.0-beta.1","2025.7.0-alpha.0","2025.6.4-alpha.4","2025.6.4-alpha.3","2025.6.4-alpha.2","2025.6.4-alpha.1","2025.6.4-alpha.0","2025.6.3","2025.6.3-alpha.0","2025.6.2","2025.6.2-alpha.0","2025.6.1","2025.6.1-rc.0","2025.6.1-beta.2","2025.6.1-beta.1","2025.6.1-beta.0","2025.6.1-alpha.4","2025.6.1-alpha.2","2025.6.1-alpha.1","2025.6.1-alpha.0","2025.6.0","2025.6.0-beta.1","2025.6.0-beta.0","2025.6.0-alpha.0","2025.5.1","2025.5.1-beta.6","2025.5.1-beta.5","2025.5.1-beta.4","2025.5.1-beta.3","2025.5.1-beta.2","2025.5.1-beta.1","2025.5.1-alpha.5","2025.5.1-alpha.4","2025.5.1-alpha.3","2025.5.1-alpha.2","2025.5.1-alpha.1","2025.5.1-alpha.0","2025.5.0","2025.5.0-rc.0","2025.5.0-beta.0","2025.5.0-alpha.2","2025.5.0-alpha.1","2025.5.0-alpha.0","2025.4.1","2025.4.1-rc.0","2025.4.1-beta.9","2025.4.1-beta.8","2025.4.1-beta.7","2025.4.1-beta.6","2025.4.1-beta.2","2025.4.1-beta.0","2025.4.1-alpha.2","2025.4.1-alpha.1","2025.4.1-alpha.0","2025.4.0","2025.4.0-rc.5","2025.4.0-rc.4","2025.4.0-rc.0","2025.4.0-beta.1","2025.4.0-beta.0","2025.4.0-alpha.0","2025.3.2-beta.21","2025.3.2-beta.20","2025.3.2-beta.19","2025.3.2-beta.17","2025.3.2-beta.15","2025.3.2-beta.14","2025.3.2-beta.13","2025.3.2-beta.12","2025.3.2-beta.11","2025.3.2-beta.10","2025.3.2-beta.9","2025.3.2-beta.8","2025.3.2-beta.5","2025.3.2-beta.4","2025.3.2-beta.2","2025.3.2-beta.1","2025.3.2-beta.0","2025.3.2-alpha.11","2025.3.2-alpha.10","2025.3.2-alpha.8","2025.3.2-alpha.4","2025.3.2-alpha.3","2025.3.2-alpha.2","2025.3.2-alpha.1","2025.3.1","2025.3.1-beta.3","2025.3.1-beta.2","2025.3.1-beta.1","2025.3.1-beta.0","2025.3.1-alpha.0","2025.3.0","2025.3.0-beta.2","2025.3.0-beta.1","2025.3.0-beta.0","2025.3.0-alpha.0","2025.2.1","2025.2.1-beta.2","2025.2.1-beta.1","2025.2.1-beta.0","2025.2.1-alpha.0","2025.2.0","2025.2.0-beta.1","2025.2.0-beta.0","2025.2.0-alpha.0","2025.1.0","2025.1.0-beta.3","2025.1.0-beta.2","2025.1.0-beta.1","2025.1.0-beta.0","2025.1.0-alpha.0","2024.11.0","2024.11.0-beta.4","2024.11.0-alpha.3","2024.11.0-alpha.2","2024.11.0-alpha.1","2024.10.2-alpha.2","2024.10.2-alpha.1","2024.10.2-alpha.0","2024.10.1","2024.10.1-beta.6","2024.10.1-beta.5","2024.10.1-beta.4","2024.10.1-beta.3","2024.10.1-beta.2","2024.10.1-beta.1","2024.10.1-alpha.0","2024.10.0","2024.10.0-beta.6","2024.10.0-beta.5","2024.10.0-beta.4","2024.10.0-beta.3","2024.10.0-beta.2","2024.10.0-alpha.1","2024.10.0-alpha.0","2024.9.0","2024.9.0-beta.14","2024.9.0-alpha.13","2024.9.0-alpha.12","2024.9.0-alpha.11","2024.9.0-alpha.10","2024.9.0-alpha.9","2024.9.0-alpha.8","2024.9.0-alpha.7","2024.9.0-alpha.6","2024.9.0-alpha.5","2024.9.0-alpha.4","2024.9.0-alpha.3","2024.9.0-alpha.2","2024.9.0-alpha.1","2024.9.0-alpha.0","2024.8.0","2024.8.0-rc.5","2024.8.0-rc.4","2024.8.0-rc.3","2024.8.0-beta.2","2024.8.0-alpha.1","2024.8.0-alpha.0","2024.7.0","2024.7.0-rc.8","2024.7.0-rc.7","2024.7.0-rc.6","2024.7.0-rc.5","2024.7.0-rc.4","2024.7.0-beta.3","2024.7.0-beta.2","2024.7.0-beta.1","2024.7.0-beta.0","2024.2.0-beta.13","2024.2.0-beta.12","2024.2.0-beta.10","2024.2.0-beta.9","2024.2.0-beta.8","2024.2.0-beta.7","2024.2.0-beta.6","2024.2.0-beta.5","2024.2.0-beta.4","2024.2.0-beta.3","2024.2.0-beta.2","2024.2.0-beta.1","2023.12.0-beta.6","2023.12.0-beta.5","2023.12.0-beta.4","2023.12.0-beta.3","2023.12.0-beta.2","2023.12.0-beta.1","2023.11.1-beta.2","2023.11.1-beta.1","2023.11.0-beta.10","2023.11.0-beta.9","2023.11.0-beta.8","2023.11.0-beta.7","2023.11.0-beta.6","2023.11.0-beta.5","2023.11.0-beta.4","2023.11.0-beta.3","2023.11.0-beta.2","2023.11.0-beta.1","2023.10.2-beta.2","2023.10.2-beta.1","2023.10.0-beta.15","2023.10.0-beta.14","2023.10.0-beta.13","2023.10.0-beta.12","2023.10.0-beta.11","2023.10.0-beta.10","2023.10.0-beta.9","2023.10.0-beta.8","2023.10.0-beta.7","2023.10.0-beta.6","2023.10.0-beta.5","2023.10.0-beta.4","2023.10.0-beta.3","2023.10.0-beta.2","2023.10.0-beta.1","13.14.2","2023.9.0-rc.4","2023.9.0-rc.3","2023.9.0-rc.2","2023.9.0-rc.1","2023.9.0-beta.11","2023.9.0-beta.10","2023.9.0-beta.9","2023.9.0-beta.8","2023.9.0-beta.7","2023.9.0-beta.6","2023.9.0-beta.5","2023.9.0-beta.4","2023.9.0-beta.3","2023.9.0-beta.2","2023.9.0-beta.1","13.14.1","13.14.0","13.13.2","13.13.1","13.13.0","13.12.2","13.12.1","13.12.0","13.11.3","13.11.2","13.11.1","13.11.0","13.10.3","13.10.2","13.10.1","13.10.0","13.9.2","13.9.1","13.9.0","13.8.1","13.8.0","13.7.5","13.7.4","13.7.3","13.7.2","13.7.1","13.7.0","13.6.1","13.6.0","13.5.6","13.5.5","13.5.4","13.5.3","13.5.2","13.5.1","13.5.0","13.4.0","13.3.4","13.3.3","13.3.2","13.3.1","13.3.0","13.2.6","13.2.5","13.2.4","13.2.3","13.2.2","13.2.1","13.2.0","13.1.8","13.1.7","13.1.6","13.1.5","13.1.4","13.1.3","13.1.2","13.1.1","13.1.0","13.0.0","12.119.1","12.119.0","12.118.1","12.118.0","12.117.1","12.117.0","12.116.1","12.116.0","12.115.0","12.114.0","12.113.0","12.112.3","12.112.2","12.112.1","12.112.0","12.111.1","12.111.0","12.110.1","12.110.0","12.109.2","12.109.1","12.109.0","12.108.1","12.108.0","12.107.0","12.106.3","12.106.2","12.106.1","12.106.0","12.105.0","12.104.0","12.103.1","12.103.0","12.102.1","12.102.0","12.101.1","12.101.0","12.100.2","12.100.1","12.100.0","12.99.3","12.99.2","12.99.1","12.99.0","12.98.0","12.97.1","12.97.0","12.96.1","12.96.0","12.95.0","12.94.1","12.94.0","12.93.2","12.93.1","12.93.0","12.92.0","12.91.0","12.90.1","12.90.0","12.89.2","12.89.1","12.89.0","12.88.0","12.87.0","12.86.0","12.85.1","12.85.0","12.84.3","12.84.2","12.84.1","12.84.0","12.83.0","12.82.0","12.81.2","12.81.1","12.81.0","12.80.3","12.80.2","12.80.1","12.80.0","12.79.3","12.79.2","12.79.1","12.79.0","12.78.0","12.77.1","12.77.0","12.76.1","12.76.0","12.75.1","12.75.0","12.74.1","12.74.0","12.73.0","12.72.0","12.71.0","12.70.0","12.69.0","12.68.0","12.67.1","12.67.0","12.66.0","12.65.7","12.65.6","12.65.5","12.65.4","12.65.3","12.65.2","12.65.1","12.65.0","12.64.2","12.64.1","12.64.0","12.63.0","12.62.2","12.62.1","12.62.0","12.61.1","12.61.0","12.60.1","12.60.0","12.59.0","12.58.0","12.57.4","12.57.1","12.57.0","12.56.0","12.55.0","12.54.0","12.53.0","12.52.0","12.51.0","12.50.0","12.49.1","12.49.0","12.48.3","12.48.2","12.48.1","12.48.0","12.47.1","12.47.0","12.46.0","12.45.1","12.45.0","12.44.1","12.44.0","12.43.0","12.42.0","12.41.3","12.41.2","12.41.1","12.41.0","12.40.0","12.39.1","12.39.0","12.38.1","12.38.0","12.37.0","12.36.1","12.36.0","12.35.2","12.35.1","12.35.0","12.34.0","12.33.0","12.32.0","12.31.0","12.30.0","12.29.0","12.21.0","12.20.0","12.19.0","12.18.1","12.18.0","12.17.0","12.16.0","12.15.0","12.14.0","12.13.0","12.12.0","12.11.0","12.10.0","12.9.0","12.8.0","12.7.1","12.7.0","12.6.0","12.5.0","12.4.1","12.4.0","12.3.0","12.2.0","12.1.0","12.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104816.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N"}]}