CVE-2026-68583 in LuCI
Summary
by MITRE • 08/02/2026
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability exists within the luci-app-adblock-fast package version 1.2.4-4 and earlier, representing a critical stored cross-site scripting flaw that undermines the security of the LuCI web interface. The weakness specifically resides in the blocklist name field where user input is not properly sanitized or validated before being rendered in the web interface. When administrators access the AdBlock Fast status page, the maliciously crafted payload embedded within the blocklist name executes within their browser context, leveraging the trusted origin of the LuCI application.
The technical exploitation occurs through a stored XSS vector where an attacker with lower privileges can inject HTML code into the blocklist name field during configuration. This input remains persistent in the application's data storage and is subsequently retrieved and displayed without proper output encoding when administrators view the status page. The vulnerability demonstrates poor input validation practices and inadequate sanitization of user-supplied content, directly violating security principles outlined in CWE-79 which addresses cross-site scripting flaws. The attack surface is particularly concerning as it leverages the administrative privileges of the LuCI interface to execute malicious code within the context of an authenticated session.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to potentially escalate privileges or perform actions that would normally require administrator access. Since the payload executes in the administrator's browser under the LuCI origin, attackers could manipulate the web interface to modify blocklists, disable security features, or even exfiltrate sensitive information from the device. This represents a significant risk in environments where multiple users have access to the LuCI interface, as a single compromised low-privileged account could lead to full administrative compromise. The vulnerability aligns with ATT&CK technique T1059.007 for scripting and T1566.002 for spearphishing with social engineering, as it enables attackers to establish persistent access through malicious web content.
Mitigation strategies should focus on immediate input sanitization and output encoding measures to prevent XSS exploitation. The application must implement strict validation of all user inputs in the blocklist name field, rejecting any HTML or script content that could be interpreted as executable code. Additionally, proper output encoding should be applied when rendering user-supplied data within the web interface to ensure that even if malicious input were to bypass validation, it would not execute as active content. The recommended solution involves upgrading to luci-app-adblock-fast version 1.2.4-4 or later, which includes patched input validation mechanisms and enhanced sanitization routines. Organizations should also consider implementing Content Security Policy headers to further limit the execution of unauthorized scripts, while monitoring for unusual activity patterns that might indicate exploitation attempts.