CVE-2026-104816: Misskey RSS Widget XSS Vulnerability

CVE-2026-104816 Overview

CVE-2026-104816 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in Misskey, an open source federated social media platform. The RSS widget components render feed item links without validating the URL scheme. An attacker who controls feed content can supply a link using an unsafe scheme such as javascript:. When a user clicks that link inside an RSS widget, the embedded script executes in the victim's browser session on the Misskey origin.

The flaw affects Misskey versions from 12.0.0 up to (but not including) 2026.7.0. The upstream maintainers resolved the issue in release 2026.7.0.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of any Misskey user who clicks a crafted feed link, enabling session theft, account takeover, and federated content manipulation.

Affected Products

Misskey versions 12.0.0 through versions prior to 2026.7.0
Deployments of Misskey instances exposing RSS-based widgets to end users
Any Misskey user interacting with attacker-controlled or compromised RSS feeds

Discovery Timeline

2026-10-13 - CVE-2026-104816 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in the NVD database
Fixed in release - Misskey 2026.7.0 (GitHub Release 2026.7.0)

Technical Details for CVE-2026-104816

Vulnerability Analysis

Misskey's RSS widgets ingest third-party feeds and render each item's title and link as a clickable anchor in the user interface. The frontend rendering path does not validate the scheme of the href attribute before assigning it to the DOM. As a result, any string the feed supplies is treated as a navigable URL.

Browsers interpret javascript: URLs as executable code when a user activates the link. Because the rendered anchor originates from the Misskey origin, the executed script inherits the user's authenticated session, cookies, and local storage. This gives the attacker the ability to call the Misskey API as the victim.

The vulnerability requires user interaction, since the payload fires only when the victim clicks a feed item in the widget. However, the attacker only needs control over a feed URL that a Misskey instance or user has subscribed to.

Root Cause

The RSS widget code imports feed item link strings and passes them directly to href bindings without scheme validation. There is no allowlist restricting navigation to http: and https: schemes. The patch introduces a tryParseUrl helper in packages/frontend-shared/js/url.ts and integrates it into the statusbar RSS widget to safely parse and filter feed URLs before rendering.

Attack Vector

The attack is network-reachable and relies on a victim clicking a feed item. An attacker publishes an RSS feed containing an item whose <link> value is javascript:/*payload*/. When a Misskey instance subscribes to that feed through an RSS widget and a user clicks the title, the browser executes the payload within the Misskey origin.

typescript

// Security patch in packages/frontend-shared/js/url.ts
// fix: RSS系ウィジェットにフィードURL検査機構を追加 (#17831)
 	return match ? match[1] : null;
 }
 
+export function tryParseUrl(url: string | URL, base?: string | URL): URL | null {
+	try {
+		return new URL(url, base);
+	} catch {
+		return null;
+	}
+}
+
 export function maybeMakeRelative(urlStr: string, baseStr: string): string {
 	try {
 		const baseObj = new URL(baseStr);

Source: GitHub Commit 8dd59a8

text

// Security patch in packages/frontend/src/ui/_common_/statusbar-rss.vue
 import * as Misskey from 'misskey-js';
 import { useInterval } from '@@/js/use-interval.js';
 import { url as baseUrl } from '@@/js/config.js';
+import { tryParseUrl } from '@@/js/url.js';
 import MkMarqueeText from '@/components/MkMarqueeText.vue';
 import { shuffle } from '@/utility/shuffle.js';

Source: GitHub Pull Request #17831

Detection Methods for CVE-2026-104816

Indicators of Compromise

Misskey server-side logs or client telemetry showing RSS widget items with href values beginning with javascript:, data:, or vbscript: schemes.
Unexpected outbound API calls from authenticated user sessions immediately following RSS widget interactions.
Instance administrators discovering RSS feed subscriptions pointing to untrusted or newly registered domains.

Detection Strategies

Inspect subscribed RSS feed payloads for <link> elements whose values do not begin with http:// or https://.
Deploy a Content Security Policy (CSP) in report-only mode on the Misskey frontend and alert on script-src violations originating from inline anchor activation.
Review browser console errors and CSP reports for javascript: URL navigation attempts tied to the RSS widget component.

Monitoring Recommendations

Monitor the Misskey instance for installations running versions earlier than 2026.7.0 and track subscription changes to RSS widgets.
Alert on user accounts that exhibit sudden session anomalies, such as new OAuth grants or follow bursts, after loading RSS widgets.
Correlate web proxy logs for feed URLs returning non-standard scheme values and flag feeds hosted on recently registered domains.

How to Mitigate CVE-2026-104816

Immediate Actions Required

Upgrade all Misskey instances to version 2026.7.0 or later, which ships the tryParseUrl scheme validation fix.
Audit configured RSS widget feed URLs and remove any sourced from untrusted or unverifiable publishers.
Rotate session tokens and API keys for user accounts suspected of clicking malicious feed items prior to patching.

Patch Information

The fix is delivered in Misskey release 2026.7.0. The relevant changes are in commit 8dd59a8c06da49b8f302d902d73d04397ee29366, merged through Pull Request #17831. Full advisory details are available in GitHub Security Advisory GHSA-p73x-6qrq-34jc.

Workarounds

Disable RSS widgets instance-wide until the upgrade to 2026.7.0 is deployed.
Restrict RSS widget usage to a curated allowlist of trusted feed URLs under administrator control.
Deploy a strict CSP that forbids javascript: URLs and inline script execution on the Misskey frontend origin.

bash

# Upgrade Misskey to the patched release
git fetch --tags
git checkout 2026.7.0
pnpm install
pnpm run build
pnpm run migrate
systemctl restart misskey