CVE-2026-54443

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54443
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54443.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54443
Aliases
  • GHSA-2x3v-qmgm-r8hv
Published
2026-07-15T18:19:31.219Z
Modified
2026-07-17T03:47:03.439544859Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Details

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.

Database specific 
{
    "cwe_ids": [
        "CWE-80",
        "CWE-84"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54443.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/lissy93/dashy

Affected ranges

Type
GIT
Repo
https://github.com/lissy93/dashy
Events
Introduced
1f5d3f45fcfbc03ac8c099fdc1614b9806dee803
Fixed
24d741488327fb66e79d0d2468f84795d791f019
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.9.4"
        },
        {
            "fixed": "3.2.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0
2.1.1
2.1.2
3.*
3.0.0
3.0.1
3.1.1
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.2
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54443.json"