CVE-2026-23768

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23768", "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6", "state": "PUBLISHED", "assignerShortName": "naver", "dateReserved": "2026-01-16T05:06:27.869Z", "datePublished": "2026-01-16T05:20:58.677Z", "dateUpdated": "2026-01-16T16:01:19.373Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "lucy-xss-filter", "repo": "https://github.com/naver/lucy-xss-filter", "vendor": "NAVER", "versions": [{"status": "unaffected", "version": "7c1de6db76749ceb7b382493da29c4348853cf6b", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "finder", "value": "ksw9722 / Kim Si Ung"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.<br>"}], "value": "lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6", "shortName": "naver", "dateUpdated": "2026-01-16T05:33:13.642Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://cve.naver.com/detail/cve-2026-23768.html"}, {"tags": ["mitigation"], "url": "https://github.com/naver/lucy-xss-filter/pull/31"}], "source": {"discovery": "EXTERNAL"}, "tags": ["unsupported-when-assigned"], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T16:00:12.874657Z", "id": "CVE-2026-23768", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T16:01:19.373Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23768", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T16:00:12.874657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T16:01:01.135Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "ksw9722 / Kim Si Ung"}], "affected": [{"repo": "https://github.com/naver/lucy-xss-filter", "vendor": "NAVER", "product": "lucy-xss-filter", "versions": [{"status": "unaffected", "version": "7c1de6db76749ceb7b382493da29c4348853cf6b", "versionType": "git"}], "defaultStatus": "affected"}], "references": [{"url": "https://cve.naver.com/detail/cve-2026-23768.html", "tags": ["vendor-advisory"]}, {"url": "https://github.com/naver/lucy-xss-filter/pull/31", "tags": ["mitigation"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.", "supportingMedia": [{"type": "text/html", "value": "lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6", "shortName": "naver", "dateUpdated": "2026-01-16T05:33:13.642Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23768", "state": "PUBLISHED", "dateUpdated": "2026-01-16T16:01:19.373Z", "dateReserved": "2026-01-16T05:06:27.869Z", "assignerOrgId": "f9629fae-ca2e-4fbf-9785-3ed86476aef6", "datePublished": "2026-01-16T05:20:58.677Z", "assignerShortName": "naver"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "lucy-xss-filter", "repo": "https://github.com/naver/lucy-xss-filter", "vendor": "NAVER", "versions": [{"status": "unaffected", "version": "7c1de6db76749ceb7b382493da29c4348853cf6b", "versionType": "git"}]}], "source": "cve@navercorp.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:naver:lucy-xss-filter:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE152946-8B7E-490F-986A-D584F6CC5D4D", "versionEndExcluding": "2025-06-08", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@navercorp.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension."}, {"lang": "es", "value": "lucy-xss-filter antes del commit 7c1de6d permite a un atacante inducir solicitudes HEAD del lado del servidor a URLs arbitrarias cuando la opci\u00f3n ObjectSecurityListener o EmbedSecurityListener est\u00e1 habilitada y se utilizan etiquetas embed u object con un atributo src al que le falta una extensi\u00f3n de archivo."}], "id": "CVE-2026-23768", "lastModified": "2026-06-17T10:22:04.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23768", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T16:00:12.874657Z", "version": "2.0.3"}}]}, "published": "2026-01-16T06:15:51.333", "references": [{"source": "cve@navercorp.com", "tags": ["Vendor Advisory"], "url": "https://cve.naver.com/detail/cve-2026-23768.html"}, {"source": "cve@navercorp.com", "tags": ["Exploit", "Patch"], "url": "https://github.com/naver/lucy-xss-filter/pull/31"}], "sourceIdentifier": "cve@navercorp.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cve@navercorp.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:09:42.387896+00:00", "value": {"mitigation_remediation": ["Upgrade the Lucy XSS filter to commit 7c1de6d or later, which removes the SSRF issue.", "If an upgrade is not immediately possible, disable the ObjectSecurityListener and EmbedSecurityListener configuration options to prevent the filter from performing server\u2011side HEAD requests.", "Implement network monitoring or firewall rules to restrict outbound HEAD requests from the server to trusted endpoints only."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The affected product is Naver\u2019s Lucy XSS filter. All versions prior to commit 7c1de6d are vulnerable. No specific version numbers are provided in the advisory. The vulnerability is tied to the ObjectSecurityListener and EmbedSecurityListener options, which are part of the filter\u2019s configuration.", "description_and_impact": "The vulnerability resides in the Lucy XSS filter used by Naver. When the ObjectSecurityListener or EmbedSecurityListener option is enabled, an attacker can craft an HTML payload that includes embed or object tags with a src attribute that lacks a file extension. This triggers the filter to perform a server\u2011side HEAD request to an arbitrary URL, exposing the server to SSRF attacks. The impact includes potential data exposure from internal services or time\u2011delay based reconnaissance, but does not provide direct code execution or privilege escalation on the host.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity. The EPSS score is less than 1%, suggesting low probability of exploit at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted web request that includes embed or object tags without a file extension, which the filter processes and turns into an outbound HEAD request. No additional deployment or privileged access prerequisites are noted in the advisory, so an attacker with the ability to deliver such payloads could exploit the flaw."}}}}, "created": "2026-01-16T13:41:48.832551+00:00", "title": "Server\u2011Side Request Forgery via XSS Filter Misconfiguration", "updated": "2026-04-18T19:15:10.612649+00:00", "vendors": ["naver", "naver$PRODUCT$lucy-xss-filter"]}