CVE-2023-25154: misskey

csirt@kutim:~/threat-intel/cve/CVE-2023-25154

CVSS 6.1 · Medium EPSS 0,43%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada misskey. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execute JavaScript code in the context of the recipient. This issue has been fixed in version 13.5.0. Users are advised to upgrade. Users unable to upgrade should not "view on remote" for untrusted instances.

Rincian

Terbit di NVD: 22 Februari 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
misskey	misskey	Semua versi sebelum 13.5.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/misskey-dev/misskey/security/advisories/GHSA-pfp5-r48x-fg25 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.