CVE-2026-91146: Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, enabling session hijacking or impersonation of viewers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
takaheto a version that resolves this vulnerability.Fixed in 0.11.0 - Compensating control
In Takahe federated post content and profile summaries, restrict link href URL schemes and disallow the javascript: URL scheme so malicious javascript: links cannot execute in the instance origin when clicked.
Event History
Frequently Asked Questions
Which deployments are exposed?
Takahe installations running version 0.11.0 or earlier are affected. The vulnerable handling applies to links in federated post content and profile summaries.
What must an attacker do to exploit this issue?
An attacker needs to deliver federated content containing a link whose href uses the javascript: URL scheme. A viewer must click that link for code to execute in the Takahe instance's origin.
Are users affected merely by viewing a malicious post or profile?
No. The described execution requires the viewer to click the malicious javascript: link.
What could an attacker gain if a user clicks a malicious link?
The injected code executes in the instance origin and may enable session hijacking or impersonation of the viewer.