CVE-2026-79663: Ech0 before 4.7.3 Stored XSS via RSS feed tag names
Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the resulting script execution?
Exploitation requires admin privileges to create malicious tag names or raw HTML in echo content. Anonymous RSS subscribers and other users are exposed if they use RSS readers that render HTML-type summaries.
Are default RSS consumers necessarily affected?
No. Script execution is described only for RSS readers that render HTML-type summaries; readers that do not render those summaries as HTML are not identified as affected.
What can be done if upgrading is not immediately possible?
The provided information identifies the injection sources as tag names and raw HTML in echo content. Restrict admin access and prevent untrusted or malicious HTML and tag names from being published until the affected installation can be updated.