High
Misskey: Cross-site scripting in RSS feed item links
Type: advisorySources: OSV
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-104816
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 11:34 UTC · Revision 1
Source evidence
Misskey: Cross-site scripting in RSS feed item links
core-osv · Original sourcePublished 13 Oct 2026, 18:38 UTC
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
osv:CVE-2026-104816
Complete source record
{
"id": "8256b8f4ac8aa8eeb6e01612638e23d2f57dab673424e12bbc009f8cbab1c9ce",
"url": "https://osv.dev/vulnerability/CVE-2026-104816",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Misskey: Cross-site scripting in RSS feed item links",
"summary": "Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.",
"evidence": "osv:CVE-2026-104816",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-104816",
"aliases": [
"CVE-2026-104816",
"GHSA-p73x-6qrq-34jc"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/misskey-dev/misskey",
"type": "GIT",
"events": [
{
"introduced": "781cebf19406c9db4c769f35a78c991326393b98"
},
{
"last_affected": "a8d45d4b0d24e0c422d4e6d8feab57035239db56"
},
{
"introduced": "2939e8131d303f27ef24541fa8394369401be08b"
},
{
"fixed": "8ea4a0ecac058688f69706ab88de1fcd439e2621"
},
{
"fixed": "8dd59a8c06da49b8f302d902d73d04397ee29366"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0"
},
{
"last_affected": "13.14.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "2023.9.0-beta.1"
},
{
"fixed": "2026.7.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "8dd59a8c06da49b8f302d902d73d04397ee29366"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "8ea4a0ecac058688f69706ab88de1fcd439e2621"
}
],
"source": "REFERENCES_TAG",
"original_tag": "2026.7.0"
}
]
}
}
],
"versions": [
"2026.7.0-rc.0",
"2026.7.0-beta.6",
"2026.7.0-beta.3",
"2026.7.0-beta.2",
"2026.7.0-beta.1",
"2026.7.0-beta.0",
"2026.7.0-alpha.5",
"2026.7.0-alpha.4",
"2026.7.0-alpha.3",
"2026.7.0-alpha.2",
"2026.7.0-alpha.1",
"2026.7.0-alpha.0",
"2026.6.1-alpha.1",
"2026.6.0-beta.1",
"2026.6.0-beta.0",
"2026.6.0-alpha.2",
"2026.6.0-alpha.1",
"2026.6.0-alpha.0",
"2026.5.4",
"2026.5.4-beta.0",
"2026.5.4-alpha.0",
"2026.5.3",
"2026.5.3-alpha.0",
"2026.5.2",
"2026.5.2-beta.1",
"2026.5.2-beta.0",
"2026.5.2-alpha.0",
"2026.5.1",
"2026.5.1-beta.0",
"2026.5.1-alpha.0",
"2026.5.0",
"2026.5.0-alpha.0",
"2026.4.0-beta.2",
"2026.4.0-beta.1",
"2026.4.0-beta.0",
"2026.4.0-alpha.6",
"2026.4.0-alpha.5",
"2026.4.0-alpha.4",
"2026.4.0-alpha.3",
"2026.4.0-alpha.2",
"2026.4.0-alpha.1",
"2026.4.0-alpha.0",
"2026.3.2",
"2026.3.2-beta.0",
"2026.3.2-alpha.2",
"2026.3.2-alpha.1",
"2026.3.2-alpha.0",
"2026.3.1",
"2026.3.1-alpha.0",
"2026.3.0",
"2026.3.0-alpha.0",
"2026.2.0-beta.0",
"2026.2.0-alpha.0",
"2026.1.0-beta.0",
"2026.1.0-alpha.4",
"2026.1.0-alpha.3",
"2026.1.0-alpha.2",
"2026.1.0-alpha.1",
"2026.1.0-alpha.0",
"2025.12.2",
"2025.12.2-beta.4",
"2025.12.2-beta.3",
"2025.12.2-beta.2",
"2025.12.2-alpha.0",
"2025.12.1",
"2025.12.1-alpha.1",
"2025.12.1-alpha.0",
"2025.12.0",
"2025.12.0-beta.0",
"2025.12.0-alpha.2",
"2025.12.0-alpha.1",
"2025.12.0-alpha.0",
"2025.11.2-alpha.4",
"2025.11.2-alpha.3",
"2025.11.2-alpha.2",
"2025.11.2-alpha.1",
"2025.11.2-alpha.0",
"2025.11.1",
"2025.11.1-beta.3",
"2025.11.1-beta.2",
"2025.11.1-beta.1",
"2025.11.1-beta.0",
"2025.11.1-alpha.2",
"2025.11.1-alpha.1",
"2025.11.1-alpha.0",
"2025.11.0",
"2025.11.0-rc.0",
"2025.11.0-beta.0",
"2025.11.0-alpha.4",
"2025.11.0-alpha.3",
"2025.11.0-alpha.2",
"2025.11.0-alpha.1",
"2025.11.0-alpha.0",
"2025.10.2",
"2025.10.2-beta.0",
"2025.10.2-alpha.0",
"2025.10.1",
"2025.10.1-beta.4",
"2025.10.1-beta.2",
"2025.10.1-beta.1",
"2025.10.1-beta.0",
"2025.10.1-alpha.6",
"2025.10.1-alpha.5",
"2025.10.1-alpha.4",
"2025.10.1-alpha.2",
"2025.10.1-alpha.1",
"2025.10.1-alpha.0",
"2025.10.0",
"2025.10.0-beta.2",
"2025.10.0-beta.1",
"2025.10.0-beta.0",
"2025.10.0-alpha.0",
"2025.9.1-alpha.2",
"2025.9.1-alpha.1",
"2025.9.1-alpha.0",
"2025.9.0",
"2025.9.0-rc.0",
"2025.9.0-beta.1",
"2025.9.0-beta.0",
"2025.9.0-alpha.2",
"2025.9.0-alpha.1",
"2025.9.0-alpha.0",
"2025.8.0",
"2025.8.0-rc.0",
"2025.8.0-beta.6",
"2025.8.0-beta.5",
"2025.8.0-beta.4",
"2025.8.0-beta.3",
"2025.8.0-beta.2",
"2025.8.0-beta.1",
"2025.8.0-beta.0",
"2025.8.0-alpha.13",
"2025.8.0-alpha.12",
"2025.8.0-alpha.11",
"2025.8.0-alpha.9",
"2025.8.0-alpha.8",
"2025.8.0-alpha.7",
"2025.8.0-alpha.6",
"2025.8.0-alpha.5",
"2025.8.0-alpha.4",
"2025.8.0-alpha.3",
"2025.8.0-alpha.2",
"2025.8.0-alpha.1",
"2025.8.0-alpha.0",
"2025.7.0",
"2025.7.0-rc.1",
"2025.7.0-rc.0",
"2025.7.0-beta.2",
"2025.7.0-beta.1",
"2025.7.0-alpha.0",
"2025.6.4-alpha.4",
"2025.6.4-alpha.3",
"2025.6.4-alpha.2",
"2025.6.4-alpha.1",
"2025.6.4-alpha.0",
"2025.6.3",
"2025.6.3-alpha.0",
"2025.6.2",
"2025.6.2-alpha.0",
"2025.6.1",
"2025.6.1-rc.0",
"2025.6.1-beta.2",
"2025.6.1-beta.1",
"2025.6.1-beta.0",
"2025.6.1-alpha.4",
"2025.6.1-alpha.2",
"2025.6.1-alpha.1",
"2025.6.1-alpha.0",
"2025.6.0",
"2025.6.0-beta.1",
"2025.6.0-beta.0",
"2025.6.0-alpha.0",
"2025.5.1",
"2025.5.1-beta.6",
"2025.5.1-beta.5",
"2025.5.1-beta.4",
"2025.5.1-beta.3",
"2025.5.1-beta.2",
"2025.5.1-beta.1",
"2025.5.1-alpha.5",
"2025.5.1-alpha.4",
"2025.5.1-alpha.3",
"2025.5.1-alpha.2",
"2025.5.1-alpha.1",
"2025.5.1-alpha.0",
"2025.5.0",
"2025.5.0-rc.0",
"2025.5.0-beta.0",
"2025.5.0-alpha.2",
"2025.5.0-alpha.1",
"2025.5.0-alpha.0",
"2025.4.1",
"2025.4.1-rc.0",
"2025.4.1-beta.9",
"2025.4.1-beta.8",
"2025.4.1-beta.7",
"2025.4.1-beta.6",
"2025.4.1-beta.2",
"2025.4.1-beta.0",
"2025.4.1-alpha.2",
"2025.4.1-alpha.1",
"2025.4.1-alpha.0",
"2025.4.0",
"2025.4.0-rc.5",
"2025.4.0-rc.4",
"2025.4.0-rc.0",
"2025.4.0-beta.1",
"2025.4.0-beta.0",
"2025.4.0-alpha.0",
"2025.3.2-beta.21",
"2025.3.2-beta.20",
"2025.3.2-beta.19",
"2025.3.2-beta.17",
"2025.3.2-beta.15",
"2025.3.2-beta.14",
"2025.3.2-beta.13",
"2025.3.2-beta.12",
"2025.3.2-beta.11",
"2025.3.2-beta.10",
"2025.3.2-beta.9",
"2025.3.2-beta.8",
"2025.3.2-beta.5",
"2025.3.2-beta.4",
"2025.3.2-beta.2",
"2025.3.2-beta.1",
"2025.3.2-beta.0",
"2025.3.2-alpha.11",
"2025.3.2-alpha.10",
"2025.3.2-alpha.8",
"2025.3.2-alpha.4",
"2025.3.2-alpha.3",
"2025.3.2-alpha.2",
"2025.3.2-alpha.1",
"2025.3.1",
"2025.3.1-beta.3",
"2025.3.1-beta.2",
"2025.3.1-beta.1",
"2025.3.1-beta.0",
"2025.3.1-alpha.0",
"2025.3.0",
"2025.3.0-beta.2",
"2025.3.0-beta.1",
"2025.3.0-beta.0",
"2025.3.0-alpha.0",
"2025.2.1",
"2025.2.1-beta.2",
"2025.2.1-beta.1",
"2025.2.1-beta.0",
"2025.2.1-alpha.0",
"2025.2.0",
"2025.2.0-beta.1",
"2025.2.0-beta.0",
"2025.2.0-alpha.0",
"2025.1.0",
"2025.1.0-beta.3",
"2025.1.0-beta.2",
"2025.1.0-beta.1",
"2025.1.0-beta.0",
"2025.1.0-alpha.0",
"2024.11.0",
"2024.11.0-beta.4",
"2024.11.0-alpha.3",
"2024.11.0-alpha.2",
"2024.11.0-alpha.1",
"2024.10.2-alpha.2",
"2024.10.2-alpha.1",
"2024.10.2-alpha.0",
"2024.10.1",
"2024.10.1-beta.6",
"2024.10.1-beta.5",
"2024.10.1-beta.4",
"2024.10.1-beta.3",
"2024.10.1-beta.2",
"2024.10.1-beta.1",
"2024.10.1-alpha.0",
"2024.10.0",
"2024.10.0-beta.6",
"2024.10.0-beta.5",
"2024.10.0-beta.4",
"2024.10.0-beta.3",
"2024.10.0-beta.2",
"2024.10.0-alpha.1",
"2024.10.0-alpha.0",
"2024.9.0",
"2024.9.0-beta.14",
"2024.9.0-alpha.13",
"2024.9.0-alpha.12",
"2024.9.0-alpha.11",
"2024.9.0-alpha.10",
"2024.9.0-alpha.9",
"2024.9.0-alpha.8",
"2024.9.0-alpha.7",
"2024.9.0-alpha.6",
"2024.9.0-alpha.5",
"2024.9.0-alpha.4",
"2024.9.0-alpha.3",
"2024.9.0-alpha.2",
"2024.9.0-alpha.1",
"2024.9.0-alpha.0",
"2024.8.0",
"2024.8.0-rc.5",
"2024.8.0-rc.4",
"2024.8.0-rc.3",
"2024.8.0-beta.2",
"2024.8.0-alpha.1",
"2024.8.0-alpha.0",
"2024.7.0",
"2024.7.0-rc.8",
"2024.7.0-rc.7",
"2024.7.0-rc.6",
"2024.7.0-rc.5",
"2024.7.0-rc.4",
"2024.7.0-beta.3",
"2024.7.0-beta.2",
"2024.7.0-beta.1",
"2024.7.0-beta.0",
"2024.2.0-beta.13",
"2024.2.0-beta.12",
"2024.2.0-beta.10",
"2024.2.0-beta.9",
"2024.2.0-beta.8",
"2024.2.0-beta.7",
"2024.2.0-beta.6",
"2024.2.0-beta.5",
"2024.2.0-beta.4",
"2024.2.0-beta.3",
"2024.2.0-beta.2",
"2024.2.0-beta.1",
"2023.12.0-beta.6",
"2023.12.0-beta.5",
"2023.12.0-beta.4",
"2023.12.0-beta.3",
"2023.12.0-beta.2",
"2023.12.0-beta.1",
"2023.11.1-beta.2",
"2023.11.1-beta.1",
"2023.11.0-beta.10",
"2023.11.0-beta.9",
"2023.11.0-beta.8",
"2023.11.0-beta.7",
"2023.11.0-beta.6",
"2023.11.0-beta.5",
"2023.11.0-beta.4",
"2023.11.0-beta.3",
"2023.11.0-beta.2",
"2023.11.0-beta.1",
"2023.10.2-beta.2",
"2023.10.2-beta.1",
"2023.10.0-beta.15",
"2023.10.0-beta.14",
"2023.10.0-beta.13",
"2023.10.0-beta.12",
"2023.10.0-beta.11",
"2023.10.0-beta.10",
"2023.10.0-beta.9",
"2023.10.0-beta.8",
"2023.10.0-beta.7",
"2023.10.0-beta.6",
"2023.10.0-beta.5",
"2023.10.0-beta.4",
"2023.10.0-beta.3",
"2023.10.0-beta.2",
"2023.10.0-beta.1",
"13.14.2",
"2023.9.0-rc.4",
"2023.9.0-rc.3",
"2023.9.0-rc.2",
"2023.9.0-rc.1",
"2023.9.0-beta.11",
"2023.9.0-beta.10",
"2023.9.0-beta.9",
"2023.9.0-beta.8",
"2023.9.0-beta.7",
"2023.9.0-beta.6",
"2023.9.0-beta.5",
"2023.9.0-beta.4",
"2023.9.0-beta.3",
"2023.9.0-beta.2",
"2023.9.0-beta.1",
"13.14.1",
"13.14.0",
"13.13.2",
"13.13.1",
"13.13.0",
"13.12.2",
"13.12.1",
"13.12.0",
"13.11.3",
"13.11.2",
"13.11.1",
"13.11.0",
"13.10.3",
"13.10.2",
"13.10.1",
"13.10.0",
"13.9.2",
"13.9.1",
"13.9.0",
"13.8.1",
"13.8.0",
"13.7.5",
"13.7.4",
"13.7.3",
"13.7.2",
"13.7.1",
"13.7.0",
"13.6.1",
"13.6.0",
"13.5.6",
"13.5.5",
"13.5.4",
"13.5.3",
"13.5.2",
"13.5.1",
"13.5.0",
"13.4.0",
"13.3.4",
"13.3.3",
"13.3.2",
"13.3.1",
"13.3.0",
"13.2.6",
"13.2.5",
"13.2.4",
"13.2.3",
"13.2.2",
"13.2.1",
"13.2.0",
"13.1.8",
"13.1.7",
"13.1.6",
"13.1.5",
"13.1.4",
"13.1.3",
"13.1.2",
"13.1.1",
"13.1.0",
"13.0.0",
"12.119.1",
"12.119.0",
"12.118.1",
"12.118.0",
"12.117.1",
"12.117.0",
"12.116.1",
"12.116.0",
"12.115.0",
"12.114.0",
"12.113.0",
"12.112.3",
"12.112.2",
"12.112.1",
"12.112.0",
"12.111.1",
"12.111.0",
"12.110.1",
"12.110.0",
"12.109.2",
"12.109.1",
"12.109.0",
"12.108.1",
"12.108.0",
"12.107.0",
"12.106.3",
"12.106.2",
"12.106.1",
"12.106.0",
"12.105.0",
"12.104.0",
"12.103.1",
"12.103.0",
"12.102.1",
"12.102.0",
"12.101.1",
"12.101.0",
"12.100.2",
"12.100.1",
"12.100.0",
"12.99.3",
"12.99.2",
"12.99.1",
"12.99.0",
"12.98.0",
"12.97.1",
"12.97.0",
"12.96.1",
"12.96.0",
"12.95.0",
"12.94.1",
"12.94.0",
"12.93.2",
"12.93.1",
"12.93.0",
"12.92.0",
"12.91.0",
"12.90.1",
"12.90.0",
"12.89.2",
"12.89.1",
"12.89.0",
"12.88.0",
"12.87.0",
"12.86.0",
"12.85.1",
"12.85.0",
"12.84.3",
"12.84.2",
"12.84.1",
"12.84.0",
"12.83.0",
"12.82.0",
"12.81.2",
"12.81.1",
"12.81.0",
"12.80.3",
"12.80.2",
"12.80.1",
"12.80.0",
"12.79.3",
"12.79.2",
"12.79.1",
"12.79.0",
"12.78.0",
"12.77.1",
"12.77.0",
"12.76.1",
"12.76.0",
"12.75.1",
"12.75.0",
"12.74.1",
"12.74.0",
"12.73.0",
"12.72.0",
"12.71.0",
"12.70.0",
"12.69.0",
"12.68.0",
"12.67.1",
"12.67.0",
"12.66.0",
"12.65.7",
"12.65.6",
"12.65.5",
"12.65.4",
"12.65.3",
"12.65.2",
"12.65.1",
"12.65.0",
"12.64.2",
"12.64.1",
"12.64.0",
"12.63.0",
"12.62.2",
"12.62.1",
"12.62.0",
"12.61.1",
"12.61.0",
"12.60.1",
"12.60.0",
"12.59.0",
"12.58.0",
"12.57.4",
"12.57.1",
"12.57.0",
"12.56.0",
"12.55.0",
"12.54.0",
"12.53.0",
"12.52.0",
"12.51.0",
"12.50.0",
"12.49.1",
"12.49.0",
"12.48.3",
"12.48.2",
"12.48.1",
"12.48.0",
"12.47.1",
"12.47.0",
"12.46.0",
"12.45.1",
"12.45.0",
"12.44.1",
"12.44.0",
"12.43.0",
"12.42.0",
"12.41.3",
"12.41.2",
"12.41.1",
"12.41.0",
"12.40.0",
"12.39.1",
"12.39.0",
"12.38.1",
"12.38.0",
"12.37.0",
"12.36.1",
"12.36.0",
"12.35.2",
"12.35.1",
"12.35.0",
"12.34.0",
"12.33.0",
"12.32.0",
"12.31.0",
"12.30.0",
"12.29.0",
"12.21.0",
"12.20.0",
"12.19.0",
"12.18.1",
"12.18.0",
"12.17.0",
"12.16.0",
"12.15.0",
"12.14.0",
"12.13.0",
"12.12.0",
"12.11.0",
"12.10.0",
"12.9.0",
"12.8.0",
"12.7.1",
"12.7.0",
"12.6.0",
"12.5.0",
"12.4.1",
"12.4.0",
"12.3.0",
"12.2.0",
"12.1.0",
"12.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104816.json"
}
}
],
"modified": "2026-10-28T02:30:34.575603538Z",
"provider": "osv",
"references": [
"https://github.com/misskey-dev/misskey/releases/tag/2026.7.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104816.json",
"https://github.com/misskey-dev/misskey/security/advisories/GHSA-p73x-6qrq-34jc",
"https://nvd.nist.gov/vuln/detail/CVE-2026-104816",
"https://github.com/misskey-dev/misskey/commit/8dd59a8c06da49b8f302d902d73d04397ee29366",
"https://github.com/misskey-dev/misskey/pull/17831"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104816.json"
}
},
"related_cves": [
{
"value": "CVE-2026-104816",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 502036,
"published_at": "2026-10-13T18:38:06.905+00:00"
}