CVE-2026-79663

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-79663
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79663.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-79663
Aliases
Published
2026-08-25T11:33:26.721Z
Modified
2026-08-28T11:30:16.699815655Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Ech0 before 4.7.3 Stored XSS via RSS feed tag names
Details

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79663.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/lin-snow/ech0

Affected ranges

Type
GIT
Repo
https://github.com/lin-snow/ech0
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6ad621d8d461c58f1a1d179c4dfbb741803f8aa5
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.7.3"
        },
        {
            "introduced": "Ech0"
        }
    ]
}

Affected versions

ech0-1.*
ech0-1.0.0
ech0-4.*
ech0-4.5.0
ech0-4.5.1
ech0-4.5.2
ech0-4.5.4
ech0-4.5.5
ech0-4.5.6
ech0-4.6.0
ech0-4.6.1
ech0-4.6.2
ech0-4.6.3
ech0-4.6.4
ech0-4.7.0
ech0-4.7.1
ech0-4.7.2
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.10
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.4.9
v2.5.0
v2.5.1
v2.5.10
v2.5.3
v2.5.4
v2.5.5
v2.5.6
v2.5.7
v2.5.8
v2.5.9
v2.6.0
v2.6.1
v2.6.10
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.6.9
v2.7.0
v2.7.1
v2.7.10
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.10
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.8.9
v2.9.0
v2.9.1
v2.9.10
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v2.9.6
v2.9.7
v2.9.8
v2.9.9
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v4.*
v4.0.0
v4.0.2
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.7
v4.2.8
v4.3.0
v4.3.1
v4.3.2
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.5.0
v4.5.1
v4.5.2
v4.5.4
v4.5.5
v4.5.6
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.6.4
v4.7.0
v4.7.1
v4.7.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79663.json"