Skip to content
Heist/ feed
Back to feed
Critical

Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards

Type: advisorySources: OSV

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-36459
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 09:08 UTC · Revision 1

Source evidence

Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards

core-osv · Original source

Published 6 Jul 2023, 18:29 UTC

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

osv:CVE-2023-36459
Complete source record
{
  "id": "fb2b6e5a2fceb1c951b40c9189053ea24ff45b3a1ee6e405e67e62a5ccb38574",
  "url": "https://osv.dev/vulnerability/CVE-2023-36459",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards",
    "summary": "Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.",
    "evidence": "osv:CVE-2023-36459",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2023-36459",
      "aliases": [
        "BIT-mastodon-2023-36459",
        "CVE-2023-36459",
        "GHSA-ccm4-vgcc-73hp"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/mastodon/mastodon",
              "type": "GIT",
              "events": [
                {
                  "introduced": "010e4f2879fe2d31bc01c035d97888d78da7ac03"
                },
                {
                  "fixed": "b10c974ba1952c545acff505bfd36feb0c60b000"
                },
                {
                  "introduced": "fb389bd73c8a4bc2924496f6041c8eee27572d21"
                },
                {
                  "fixed": "8d7f6550f91338fb69e5c6e0cd28653122784665"
                },
                {
                  "introduced": "61c5dfb9295ea66c376c452a7ef7379e8c562416"
                },
                {
                  "fixed": "0d5781ca7609590a6d5340bb685bb1804056bb46"
                },
                {
                  "fixed": "6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.3"
                      },
                      {
                        "fixed": "3.5.9"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.0.0"
                      },
                      {
                        "fixed": "4.0.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.1.0"
                      },
                      {
                        "fixed": "4.1.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b10c974ba1952c545acff505bfd36feb0c60b000"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v3.5.9"
                  },
                  {
                    "range": [
                      {
                        "fixed": "8d7f6550f91338fb69e5c6e0cd28653122784665"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v4.0.5"
                  },
                  {
                    "range": [
                      {
                        "fixed": "0d5781ca7609590a6d5340bb685bb1804056bb46"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v4.1.3"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.5.8",
            "v4.0.4",
            "v4.1.2",
            "v4.1.1",
            "v4.0.3",
            "v3.5.7",
            "v3.5.6",
            "v4.0.2",
            "v4.1.0",
            "v3.5.5",
            "v4.0.1",
            "v3.5.4",
            "v4.0.0",
            "v3.5.3",
            "v3.5.2",
            "v3.5.1",
            "v3.5.0",
            "v3.5.0rc3",
            "v3.5.0rc2",
            "v3.5.0rc1",
            "v3.3.0",
            "v3.4.1",
            "v3.4.0",
            "v3.4.0rc2",
            "v3.4.0rc1",
            "v3.3.0rc3",
            "v3.3.0rc2",
            "v3.3.0rc1",
            "v3.2.0",
            "v3.2.0rc2",
            "v3.2.0rc1",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.0.1",
            "v3.1.1",
            "v3.1.0",
            "v3.1.0rc2",
            "v3.1.0rc1",
            "v3.0.0",
            "v3.0.0rc3",
            "v3.0.0rc2",
            "v3.0.0rc1",
            "v2.9.2",
            "v2.9.1",
            "v2.9.0",
            "v2.9.0rc2",
            "v2.9.0rc1",
            "v2.8.2",
            "v2.8.1",
            "v2.8.0",
            "v2.8.0rc3",
            "v2.8.0rc2",
            "v2.8.0rc1",
            "v2.7.1",
            "v2.7.0",
            "v2.7.0rc3",
            "v2.7.0rc2",
            "v2.7.0rc1",
            "v2.6.1",
            "v2.6.0",
            "v2.6.0rc4",
            "v2.6.0rc3",
            "v2.6.0rc2",
            "v2.6.0rc1",
            "v2.5.0",
            "v2.5.0rc2",
            "v2.5.0rc1",
            "v2.4.3",
            "v2.4.3rc3",
            "v2.4.3rc2",
            "v2.4.3rc1",
            "v2.4.2",
            "v2.4.2rc3",
            "v2.4.2rc2",
            "v2.4.2rc1",
            "v2.4.1",
            "v2.4.1rc4",
            "v2.4.1rc3",
            "v2.4.1rc2",
            "v2.4.1rc1",
            "v2.4.0",
            "v2.4.0rc5",
            "v2.4.0rc4",
            "v2.4.0rc3",
            "v2.4.0rc2",
            "v2.4.0rc1",
            "v2.3.2",
            "v2.3.2rc5",
            "v2.3.2rc4",
            "v2.3.2rc3",
            "v2.3.2rc2",
            "v2.3.2rc1",
            "v2.3.1",
            "v2.3.1rc3",
            "v2.3.1rc2",
            "v2.3.1rc1",
            "v2.3.0",
            "v2.3.0rc3",
            "v2.3.0rc2",
            "v2.3.0rc1",
            "v2.2.0",
            "v2.2.0rc2",
            "v2.2.0rc1",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.1.0rc6",
            "v2.1.0rc5",
            "v2.1.0rc4",
            "v2.1.0rc3",
            "v2.1.0rc2",
            "v2.1.0rc1",
            "v2.0.0",
            "v2.0.0rc4",
            "v2.0.0rc3",
            "v2.0.0rc2",
            "v2.0.0rc1",
            "v1.6.1",
            "v1.6.0",
            "v1.6.0rc5",
            "v1.6.0rc4",
            "v1.6.0rc3",
            "v1.6.0rc2",
            "v1.6.0rc1",
            "v1.5.1",
            "v1.5.0",
            "v1.5.0rc3",
            "v1.5.0rc2",
            "v1.5.0rc1",
            "v1.4.7",
            "v1.4.6",
            "v1.4.5",
            "v1.4.4",
            "v1.4.3",
            "v1.4.2",
            "v1.4.1",
            "v1.4rc6",
            "v1.4rc5",
            "v1.4rc4",
            "v1.4rc3",
            "v1.4rc2",
            "v1.4rc1",
            "v1.3.2",
            "v1.3.1",
            "v1.3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36459.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:47.188252258Z",
      "provider": "osv",
      "references": [
        "https://github.com/mastodon/mastodon/releases/tag/v3.5.9",
        "https://github.com/mastodon/mastodon/releases/tag/v4.0.5",
        "https://github.com/mastodon/mastodon/releases/tag/v4.1.3",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36459.json",
        "https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-36459",
        "https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36459.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-36459",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 515056,
  "published_at": "2023-07-06T18:29:07.669+00:00"
}