CVE-2025-59948

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59948
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59948.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59948
Aliases
  • GHSA-rwhf-vjjx-gmm9
Published
2025-09-29T22:56:46.073Z
Modified
2026-04-10T05:32:15.748791Z
Severity
  • 6.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L CVSS Calculator
Summary
FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page
Details

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to be enabled by the instance administrator beforehand for the attack to work as it relies on api/query.php. An account takeover is possible by sending a change password request via the XSS payload / setting UserJS for persistence / stealing the autofill password / displaying a phishing page with a spoofed URL using history.replaceState() If the victim is an administrator, the attacker can also perform administrative actions. This issue is fixed in version 1.27.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59948.json"
}
References

Affected packages

Git / github.com/freshrss/freshrss

Affected ranges

Type
GIT
Repo
https://github.com/freshrss/freshrss
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
66e2f00223b915c337291c0f34876d6390fb1c80

Affected versions

0.*
0.1.0
0.5.0
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
1.*
1.0.0
1.10.0
1.10.1
1.10.2
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.14.1
1.14.2
1.14.3
1.15.0
1.15.1
1.15.2
1.16.0
1.16.1
1.16.2
1.17.0
1.18.0
1.18.1
1.19.0
1.19.1
1.19.2
1.2.0
1.20.0
1.20.1
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.24.1
1.24.2
1.24.3
1.25.0
1.26.0
1.26.1
1.26.2
1.26.3
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0
1.8.0
1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59948.json"