CVE-2026-55592: Dashy XSS Vulnerability

CVE-2026-55592 Overview

CVE-2026-55592 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Dashy, a self-hostable personal dashboard application. Versions prior to 4.3.7 trust the url query parameter in the workspace view and assign it directly to an iframe src attribute without scheme validation. An attacker can craft a workspace link containing a javascript: URL that executes JavaScript on the Dashy origin when opened by an authenticated user. The injected script reads same-origin browser data, manipulates the Dashy Document Object Model (DOM), and issues requests as the victim. The issue is fixed in version 4.3.7.

Critical Impact
An authenticated user opening a crafted workspace URL triggers same-origin JavaScript execution, exposing session data and enabling actions on behalf of the victim.

Affected Products

Dashy versions prior to 4.3.7
Component: src/views/Workspace.vue workspace view
Fixed in Dashy 4.3.7

Discovery Timeline

2026-07-07 - CVE-2026-55592 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55592

Vulnerability Analysis

The Dashy workspace view reads the url query parameter from the browser location and binds it directly to an iframe source. The application performs no scheme validation before rendering, so URLs using the javascript: pseudo-scheme are accepted alongside http: and https: values. When the iframe loads a javascript: URI, the browser executes the payload in the context of the parent document because the iframe inherits the Dashy origin.

Exploitation requires that the victim is already authenticated to Dashy and clicks a crafted link. The injected script runs with full same-origin privileges. It can read localStorage, sessionStorage, and cookies not marked HttpOnly, extract configuration data, and issue authenticated requests to the Dashy backend. The attack fits the CWE-79 pattern of reflected Cross-Site Scripting through client-side sink assignment.

Root Cause

The root cause is missing URL scheme validation before assigning user-controlled input to an iframe src binding in Workspace.vue. The component treats the url query parameter as trusted content and does not filter dangerous schemes such as javascript:, data:, or vbscript:.

Attack Vector

The attack vector is local and user-interaction dependent. An attacker distributes a link of the form https://<dashy-host>/#/workspace?url=javascript:<payload> through phishing, chat, or a compromised page. When an authenticated Dashy user follows the link, the payload executes on the Dashy origin.

text

// Security patch in src/views/Workspace.vue (GHSA-58mp-4qr3-vmrc)
 import MultiTaskingWebComtent from '@/components/Workspace/MultiTaskingWebComtent';
 import Defaults from '@/utils/config/defaults';
 import ErrorHandler from '@/utils/logging/ErrorHandler';
+import { sanitizeUrl } from '@/utils/Sanitizer';

 export default {
   name: 'Workspace',

Source: GitHub Commit 4bc620e. The patch introduces a sanitizeUrl helper that filters non-HTTP schemes before the URL is passed to the iframe binding.

Detection Methods for CVE-2026-55592

Indicators of Compromise

Web server or reverse-proxy logs containing requests to the Dashy workspace route with a url query parameter beginning with javascript:, data:, or vbscript:.
Unexpected outbound requests from browser sessions immediately after loading a Dashy workspace URL.
Browser console entries showing script execution originating from iframe src assignments on the Dashy origin.

Detection Strategies

Inspect access logs for the workspace route and alert on url= values that do not begin with http:// or https://.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts on the Dashy origin.
Correlate authenticated Dashy sessions with anomalous API calls issued from the same session within seconds of a workspace navigation event.

Monitoring Recommendations

Enable verbose HTTP logging on the Dashy reverse proxy and retain query strings for at least 30 days.
Monitor referrer patterns showing Dashy links delivered from external mail, chat, or link-shortener domains.
Track Dashy release notifications so operators receive advisories for future workspace-view issues.

How to Mitigate CVE-2026-55592

Immediate Actions Required

Upgrade Dashy to version 4.3.7 or later, which introduces sanitizeUrl for the workspace url parameter.
Invalidate active Dashy sessions and rotate any API tokens stored in the browser after upgrading.
Restrict Dashy access to authenticated users on trusted networks until the patch is applied.

Patch Information

The fix is available in Dashy Release 4.3.7. The patch commit 4bc620e2 imports a sanitizeUrl utility and applies it before the iframe binding, rejecting javascript: and other dangerous schemes. Details are documented in GitHub Security Advisory GHSA-58mp-4qr3-vmrc.

Workarounds

Block the workspace route at the reverse proxy when the url parameter does not begin with http:// or https://.
Deploy a strict Content Security Policy that disallows javascript: URIs and inline script execution on the Dashy origin.
Educate users to avoid opening Dashy workspace links received from untrusted sources until the upgrade is complete.

bash

# Example NGINX rule to reject non-HTTP schemes on the workspace route
location /workspace {
    if ($arg_url !~* "^https?://") {
        return 400;
    }
    proxy_pass http://dashy_upstream;
}