CVE-2026-54443: Dashy RSS Widget XSS Vulnerability

CVE-2026-54443 Overview

CVE-2026-54443 is a Cross-Site Scripting (XSS) vulnerability in Dashy, a self-hostable personal dashboard application. The flaw resides in the RSS Widget component src/components/Widgets/RssFeed.vue, which fails to sanitize RSS item link values before rendering them as anchor href attributes. An attacker who controls or compromises an RSS feed consumed by Dashy can inject a javascript: URI into feed item links. When a user clicks the rendered title or the Read More link, the payload executes in the Dashy origin. Versions 1.9.4 through 3.1.x are affected. The issue is fixed in Dashy 3.2.0.

Critical Impact
Attacker-controlled RSS feeds can execute arbitrary JavaScript in the Dashy origin, enabling session theft, dashboard tampering, and pivoting to other integrated services.

Affected Products

Dashy versions 1.9.4 through 3.1.x
src/components/Widgets/RssFeed.vue component
Self-hosted Dashy dashboards consuming untrusted RSS feeds

Discovery Timeline

2026-07-15 - CVE-2026-54443 published to NVD
2026-07-15 - Last updated in NVD database
3.2.0 - Dashy release containing the fix published on GitHub

Technical Details for CVE-2026-54443

Vulnerability Analysis

The Dashy RSS Widget consumes third-party RSS feeds and renders each item's title and Read More control as HTML anchors. The component binds the feed-provided <link> value directly to the anchor href attribute without validating the URI scheme. Because browsers treat javascript: as an executable pseudo-scheme when placed in href, a crafted feed entry converts a user click into script execution inside the Dashy origin. The vulnerability is categorized under [CWE-80], improper neutralization of script-related HTML tags in a web page.

Root Cause

The root cause is missing URI scheme validation in the RSS feed rendering path. The widget trusts feed content and passes the link field straight to Vue's template binding for href. There is no allowlist restricting URIs to http: and https:, and no output encoding that neutralizes the javascript: pseudo-scheme. Feed data from remote, attacker-influenceable sources reaches a security-sensitive sink unchanged.

Attack Vector

Exploitation requires an attacker to control or tamper with an RSS feed that a Dashy instance is configured to display. The attacker publishes a feed item whose <link> element contains a javascript: URI carrying an XSS payload. When a Dashy user opens the dashboard and clicks the feed item title or its Read More link, the payload runs in the Dashy origin. The script can read cookies and local storage, issue authenticated requests to Dashy, and interact with any single sign-on session shared with the origin.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-2x3v-qmgm-r8hv for advisory details.

Detection Methods for CVE-2026-54443

Indicators of Compromise

RSS feed responses containing <link> elements that begin with javascript:, data:, or vbscript: schemes.
Browser console errors or unexpected script execution originating from the Dashy origin when interacting with RSS widgets.
Outbound requests from user browsers to unfamiliar domains immediately after clicking RSS feed items in Dashy.

Detection Strategies

Inspect Dashy configuration (conf.yml) for RSS widget entries and enumerate the feed URLs currently trusted by the deployment.
Proxy or log outbound HTTP requests from the Dashy server fetching RSS feeds, and scan cached feed payloads for non-http(s) URI schemes in <link> fields.
Review web server and reverse proxy logs for anomalous requests from authenticated Dashy sessions that correlate with feed refresh intervals.

Monitoring Recommendations

Alert on RSS feed content where item link values fail an ^https?:// regular expression check.
Monitor the Dashy version string exposed by the running instance and flag deployments below 3.2.0.
Track user-reported anomalies such as unexpected redirects, pop-ups, or credential prompts after opening the dashboard.

How to Mitigate CVE-2026-54443

Immediate Actions Required

Upgrade all Dashy instances to version 3.2.0 or later, which sanitizes RSS item link values before rendering.
Audit the RSS feed sources configured in Dashy and remove any feeds from untrusted or unauthenticated origins.
Rotate any session cookies or API tokens that may have been exposed if suspicious feed content was previously rendered.

Patch Information

The maintainer released the fix in Dashy 3.2.0. The patched RssFeed.vue validates feed item link URIs before assignment to anchor href attributes, blocking the javascript: pseudo-scheme. Refer to the GitHub Security Advisory GHSA-2x3v-qmgm-r8hv for full remediation details.

Workarounds

Disable RSS widgets in conf.yml until the upgrade to 3.2.0 is completed.
Restrict Dashy RSS widgets to feeds published by trusted, authenticated sources under organizational control.
Deploy a strict Content Security Policy that disallows inline script execution and blocks javascript: URIs in the Dashy origin.

bash

# Example Content-Security-Policy header for the reverse proxy fronting Dashy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';";