CVE-2026-63135

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63135", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-15T16:54:55.817Z", "datePublished": "2026-08-21T20:40:08.199Z", "dateUpdated": "2026-08-26T17:40:42.981Z"}, "containers": {"cna": {"title": "YOURLS: Stored XSS in referrer statistics chart via crafted Referer header", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"}, {"name": "https://github.com/YOURLS/YOURLS/pull/4107", "tags": ["x_refsource_MISC"], "url": "https://github.com/YOURLS/YOURLS/pull/4107"}, {"name": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7", "tags": ["x_refsource_MISC"], "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"}, {"name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"}], "affected": [{"vendor": "YOURLS", "product": "YOURLS", "versions": [{"version": ">= 1.5.1, < 1.10.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T20:40:08.199Z"}, "descriptions": [{"lang": "en", "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."}], "source": {"advisory": "GHSA-5h77-88j3-r659", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T17:40:19.146156Z", "id": "CVE-2026-63135", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T17:40:42.981Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63135", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T17:40:19.146156Z"}}}], "references": [{"url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T17:40:39.251Z"}}], "cna": {"title": "YOURLS: Stored XSS in referrer statistics chart via crafted Referer header", "source": {"advisory": "GHSA-5h77-88j3-r659", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "YOURLS", "product": "YOURLS", "versions": [{"status": "affected", "version": ">= 1.5.1, < 1.10.4"}]}], "references": [{"url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659", "name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/YOURLS/YOURLS/pull/4107", "name": "https://github.com/YOURLS/YOURLS/pull/4107", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7", "name": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4", "name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T20:40:08.199Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63135", "state": "PUBLISHED", "dateUpdated": "2026-08-26T17:40:42.981Z", "dateReserved": "2026-07-15T16:54:55.817Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T20:40:08.199Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "YOURLS", "vendor": "YOURLS", "versions": [{"status": "affected", "version": ">= 1.5.1, < 1.10.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."}, {"lang": "es", "value": "YOURLS es un acortador de URL autoalojado y personalizable escrito en PHP. Desde la versi\u00f3n 1.5.1 hasta la 1.10.4, YOURLS almacena el encabezado HTTP Referer a trav\u00e9s de yourls_get_referrer(), yourls_sanitize_url_safe() y yourls_log_redirect(), luego agrega el valor en yourls-infos.php y pasa el dominio derivado a trav\u00e9s de yourls_get_domain(), yourls_stats_pie() y yourls_google_array_to_data_table(). El generador de gr\u00e1ficos concatena etiquetas en JavaScript en l\u00ednea sin escape de cadenas de JavaScript, por lo que un atacante no autenticado puede envenenar las estad\u00edsticas de una URL corta existente con un referente manipulado. Cuando un administrador o un visor de la p\u00e1gina de estad\u00edsticas p\u00fablica abre la p\u00e1gina de estad\u00edsticas afectada, el JavaScript controlado por el atacante se ejecuta en el origen de YOURLS y puede acceder a datos visibles para el administrador, el token de firma de la API y acciones privilegiadas del mismo origen. Este problema est\u00e1 corregido en la versi\u00f3n 1.10.4."}], "id": "CVE-2026-63135", "lastModified": "2026-10-14T21:10:00.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63135", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T17:40:19.146156Z", "version": "2.0.3"}}]}, "published": "2026-08-21T21:17:01.493", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"}, {"source": "security-advisories@github.com", "url": "https://github.com/YOURLS/YOURLS/pull/4107"}, {"source": "security-advisories@github.com", "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.1,1.10.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "YOURLS", "source": "cna", "vendor": "YOURLS"}, "product": "yourls", "vendor": "yourls"}], "created": "2026-08-21T21:18:06.209500+00:00", "updated": "2026-08-21T21:30:17.742623+00:00", "vendors": ["yourls", "yourls$PRODUCT$yourls"]}