CVE-2026-104816: Misskey: Cross-site scripting in RSS feed item links
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Misskeyto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running Misskey versions from 12.0.0 through versions before 2026.7.0 are affected if they display RSS feed items from configured feeds. Users are exposed when they click a malicious feed item link in an RSS widget.
What does an attacker need to exploit it?
An attacker needs control over content in a configured RSS feed and must supply a link using an unsafe URL scheme. Exploitation also requires a user to click that link in the RSS widget.
Is there a fix?
Yes. Upgrade Misskey to version 2026.7.0, which adds URL scheme verification for RSS feed item links.