CVE-2026-104816 in Misskey
Summary
by MITRE • 10/13/2026
Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme link that causes script execution when a user clicks it in an RSS widget. This issue is fixed in version 2026.7.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
Misskey, as an open-source federated social media platform, relies heavily on the integration of external content to provide users with rich and diverse information streams. A critical security flaw was identified within its RSS components spanning from version 12.0.0 up until version 2026.7.0. The vulnerability stems from a failure in input validation specifically regarding URL scheme verification for feed item links. When the application processes feeds configured by users or administrators, it displays these links directly without checking whether they adhere to safe protocols such as HTTP or HTTPS. This oversight creates a significant security gap that can be exploited through maliciously crafted RSS feeds.
The technical nature of this vulnerability is classified under CWE-79, which pertains to Cross-Site Scripting (XSS). By omitting the verification of URL schemes, Misskey inadvertently allows for the injection of JavaScript URIs into the rendered feed items. When a user interacts with an RSS widget and clicks on one of these maliciously constructed links, the browser interprets the javascript: scheme as executable code rather than a navigational link to another webpage. This results in the immediate execution of arbitrary scripts within the context of the Misskey application domain. The attacker does not need direct access to the server but must control or influence the content of an RSS feed that is consumed by the victim, leveraging the trust relationship between the user and their subscribed feeds.
From a threat actor perspective, this vulnerability aligns with ATT&CK technique T1059, specifically Command and Scripting Interpretation via JavaScript. The operational impact of this flaw can be severe depending on the privileges of the affected account. An attacker could use script execution to steal session cookies or authentication tokens, leading to full account takeover. Furthermore, the scripts could perform actions on behalf of the user without their knowledge, such as posting malicious content, sending messages to other users, or modifying settings. In a federated environment like Misskey, this vulnerability also poses risks related to social engineering and phishing, where attackers can craft deceptive links that appear legitimate but trigger harmful payloads upon interaction.
The resolution for this issue was implemented in version 2026.7.0 of the Misskey software. The fix involves enforcing strict validation rules on URL schemes before they are rendered within the RSS widget interface. By ensuring that only safe protocols like HTTP and HTTPS are permitted, the application prevents the browser from executing scripts embedded via javascript: URIs. Administrators and users running instances of Misskey should upgrade to version 2026.7.0 or later immediately to mitigate this risk. Additionally, it is recommended to review any custom RSS feeds currently configured within the platform to ensure they originate from trusted sources, as even with the patch in place, social engineering attacks using other vectors may still pose a threat if users are not vigilant about their feed subscriptions.