CVE-2026-91146 in Takahe
Summary
by MITRE • 09/15/2026
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, enabling session hijacking or impersonation of viewers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Takahe versions through 0.11.0 represents a critical failure in input validation and output encoding within the federated social media protocol implementation. Specifically, the application fails to restrict URL schemes when processing link href attributes embedded within federated post content and user profile summaries. This oversight allows remote actors to inject malicious javascript: URI schemes into these fields. In standard web security practices, HTML anchor tags are expected to contain valid HTTP or HTTPS URLs that navigate users to external resources. However, the javascript: scheme is a special type of URL that instructs the browser's rendering engine to execute JavaScript code rather than navigating to a new page. By failing to sanitize this specific input vector, Takahe inadvertently creates an opportunity for Cross-Site Scripting attacks within its federated content stream.
The technical flaw lies in the lack of strict allow-listing or scheme validation during the parsing and rendering phases of federated data. When a user views a post or profile summary from another instance that contains a link with a javascript: href, the browser interprets this as executable code rather than a navigational element. This behavior is consistent with CWE-79, which classifies improper neutralization of input during web page generation known as Cross-Site Scripting. The vulnerability specifically targets the handling of untrusted data from federated sources, where the application assumes that content received via ActivityPub or similar protocols is safe for direct rendering without sufficient sanitization. This misconfiguration effectively bypasses standard browser security models because the malicious script executes in the context of the Takahe instance's origin rather than a third-party domain.
The operational impact of this vulnerability is severe, primarily centering on session hijacking and user impersonation. When an authenticated user clicks or interacts with such a malicious link, the injected JavaScript code runs within the security context of the Takahe application. This grants the attacker access to sensitive browser storage mechanisms, including cookies, local storage, and session tokens that are typically protected by SameSite attributes but can still be accessed via script execution if not properly secured against XSS vectors. An adversary could exploit this capability to steal active session identifiers, allowing them to impersonate the victim user on their behalf. This enables unauthorized access to private messages, personal data, and administrative functions depending on the compromised account's privileges. Furthermore, attackers could use this vector for phishing campaigns by redirecting users to malicious sites or manipulating the interface to deceive victims into revealing credentials.
This vulnerability aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution in web browsers. The attack path involves delivering a payload through federated content and triggering its execution via user interaction, typically clicking the malicious link. To mitigate this risk, immediate remediation should focus on implementing strict input validation that rejects or escapes any URL schemes other than http, https, mailto, tel, and other explicitly allowed safe protocols. Developers must ensure that all href attributes are sanitized using a robust allow-list approach rather than relying solely on blacklist filters which can be bypassed through encoding tricks or alternative scheme variations. Additionally, implementing Content Security Policy headers with strict script-src directives can provide an additional layer of defense by preventing the execution of inline scripts and unauthorized external resources even if XSS is successfully injected. Regular security audits of federated content handling logic are recommended to ensure that future updates maintain rigorous standards for input sanitization across all user-facing components.