{"id":"CVE-2026-97723","details":"madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated href attribute and introduce attacker-controlled HTML attributes, allowing arbitrary JavaScript to execute in the browser of another user when the stored chat message was rendered. No click on the malicious link was required.","modified":"2026-09-27T03:30:56.751265203Z","published":"2026-09-25T01:53:43.733Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"0.1.58"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","extracted_events":[{"introduced":"ka9q_ubersdr"},{"fixed":"0.1.58"}]}],"cna_assigner":"mitre","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97723.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97723.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97723"},{"type":"REPORT","url":"https://github.com/madpsy/ka9q_ubersdr/pull/114"},{"type":"FIX","url":"https://github.com/madpsy/ka9q_ubersdr/commit/6aa858da1c030cae11b94c7d6c72322adb9ec60d"},{"type":"PACKAGE","url":"https://github.com/madpsy/ka9q_ubersdr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/madpsy/ka9q_ubersdr","events":[{"introduced":"0"},{"fixed":"6aa858da1c030cae11b94c7d6c72322adb9ec60d"}],"database_specific":{"source":"REFERENCES"}}],"versions":["latest","0.1.17","0.1.11","0.1.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97723.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}