cve.bz

CVE-2026-79663

4.8 mediumEPSS 0.3%

Medium (4.8). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/lin-snow/Ech0 1.4.8-0.20260503035519-fd320fe3e902.

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.

Severity

CVSS 4.0

4.8 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

4.8 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-11-01)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-3v85-fqvh-7rxfGogithub.com/lin-snow/Ech0<1.4.8-0.20260503035519-fd320fe3e9021.4.8-0.20260503035519-fd320fe3e902
GO-2026-5100Gogithub.com/lin-snow/ech0<1.4.8-0.20260503035519-fd320fe3e9021.4.8-0.20260503035519-fd320fe3e902

References

Check your stackJSON