Misskey: Cross-site scripting in RSS feed item links
Summary
Misskey, an open source federated social media platform, does not verify the URL scheme of feed item links shown in its RSS widgets. An attacker who controls feed content can supply a link with an unsafe scheme that executes script in the browser of a user who clicks it. Exploitation requires user interaction, and the affected feed must be configured in an RSS widget.
Affected
- Misskey from 12.0.0 up to and including 13.14.2
- Misskey from 2023.9.0-beta.1 before 2026.7.0
Fixed in
- Misskey 2026.7.0 (fixed in the RSS widgets by validating feed link URLs as http or https)
Workaround
Unknown.
Exploitation
- No known exploitation (CISA SSVC: exploitation none, automatable yes, technical impact partial).
Our recommendation
- Update Misskey to version 2026.7.0 or later.
- If you run a self-hosted Misskey instance, check whether RSS widgets are in use and review configured feeds.
- Inform users not to click links from RSS widgets when the instance has not been updated.
- Monitor the vendor advisory for further updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p73x-6qrq-34jc github.com
- Misskey release 2026.7.0 github.com
- Fix commit 8dd59a8c github.com
- Pull request #17831 github.com
- OSV entry CVE-2026-104816 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:43.
Original description (NVD)
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.