CVE-2026-67352 in LuCI
Summary
by MITRE • 08/01/2026
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists within the luci-app-https-dns-proxy software component which is part of the OpenWrt firmware ecosystem. The stored cross-site scripting flaw manifests in the resolver_url parameter where user input is not properly sanitized or escaped before being rendered in the web interface. The vulnerability specifically affects authenticated users who can manipulate the DNS proxy configuration settings, creating a scenario where malicious HTML content can be persistently stored within the application's data structures.
The technical execution of this vulnerability occurs when an administrator navigates to the HTTPS DNS Proxy status page, which displays the resolver URL value without proper HTML escaping or sanitization. This failure to implement proper output encoding creates an environment where JavaScript code injected through the resolver_url parameter can execute in the context of the administrator's browser session. The vulnerability is classified as stored XSS because the malicious payload is permanently saved within the application's database or configuration files rather than being reflected in a single request.
The operational impact of this vulnerability is significant for network administrators who rely on OpenWrt-based routers with the luci-app-https-dns-proxy installed. An authenticated attacker can leverage this flaw to execute arbitrary JavaScript code within the administrator's browser, potentially leading to session hijacking, credential theft, or privilege escalation within the router's management interface. The attack requires only a user with administrative privileges to view the status page, making it particularly dangerous in environments where multiple administrators have access to the device configuration.
This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and maps to ATT&CK technique T1059.007 for JavaScript execution within compromised browser contexts. The flaw demonstrates poor input validation and output encoding practices that violate secure coding principles recommended by organizations such as OWASP and NIST. The vulnerability affects the integrity of the web application's user interface and can potentially be exploited to establish persistent access to router management functions.
Mitigation strategies include implementing proper HTML escaping and sanitization for all user-supplied content rendered in web interfaces, applying input validation to reject malicious payloads before storage, and ensuring that all output is properly encoded for the target context. Administrators should also consider implementing role-based access controls to limit configuration changes to trusted users only, and regularly updating firmware versions that contain patched implementations of the HTTPS DNS proxy functionality. Additionally, network segmentation and monitoring of administrator sessions can help detect potential exploitation attempts targeting this class of vulnerability.