CVE-2023-25154: Cross site scripting (XSS) of ActivityPub URI in misskey
Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execute JavaScript code in the context of the recipient. This issue has been fixed in version 13.5.0. Users are advised to upgrade. Users unable to upgrade should not "view on remote" for untrusted instances.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-25154?
CVE-2023-25154 is a vulnerability in the Misskey social media platform that allows an attacker to execute JavaScript code.
What is the severity of CVE-2023-25154?
CVE-2023-25154 has a severity rating of high (6.1).
How does CVE-2023-25154 affect Misskey?
CVE-2023-25154 affects Misskey versions prior to 13.5.0, allowing an attacker to execute malicious JavaScript code.
How can I fix CVE-2023-25154?
To fix CVE-2023-25154, users should update their Misskey instances to version 13.5.0 or later.
Where can I find more information about CVE-2023-25154?
More information about CVE-2023-25154 can be found in the Misskey Github security advisory: https://github.com/misskey-dev/misskey/security/advisories/GHSA-pfp5-r48x-fg25