CVE-2026-63135: YOURLS URL Shortener XSS Vulnerability

CVE-2026-63135 Overview

CVE-2026-63135 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in YOURLS, a self-hosted URL shortener written in PHP. The flaw affects versions from 1.5.1 through 1.10.3 and is fixed in 1.10.4. YOURLS captures the HTTP Referer header when a short URL is visited, then renders the derived domain as chart labels on statistics pages. The chart builder concatenates those labels into inline JavaScript without JavaScript-string escaping. An unauthenticated attacker can poison statistics for any existing short URL by sending a crafted referrer, causing script execution when an administrator or public viewer loads the stats page.

Critical Impact
Attacker-controlled JavaScript executes in the YOURLS origin, exposing admin-visible data, the API signature token, and privileged same-origin actions.

Affected Products

YOURLS versions 1.5.1 through 1.10.3
YOURLS includes/functions-infos.php chart rendering
Public and admin statistics pages (yourls-infos.php)

Discovery Timeline

2026-08-21 - CVE-2026-63135 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-63135

Vulnerability Analysis

YOURLS logs the HTTP Referer header of every visitor through yourls_get_referrer(), sanitizes it with yourls_sanitize_url_safe(), and stores it via yourls_log_redirect(). The statistics page yourls-infos.php aggregates referrer values and derives domain names using yourls_get_domain(). Those domain labels are then passed to yourls_stats_pie() and yourls_google_array_to_data_table(), which build a Google Charts data table by concatenating labels directly into an inline <script> block.

Because the labels are only URL-sanitized rather than JavaScript-string escaped, characters such as ', ", </script>, and backslashes break out of the string literal context. An unauthenticated attacker sends a request to any short URL with a crafted Referer value. The malicious label is persisted and rendered on every subsequent visit to the corresponding statistics page.

Root Cause

The root cause is missing output encoding for a JavaScript string context. URL sanitization does not neutralize characters that are dangerous inside inline JavaScript literals. yourls_google_array_to_data_table() trusts the derived domain string and interpolates it into script content without escaping quotes or angle brackets.

Attack Vector

Exploitation requires no authentication. The attacker issues an HTTP request to a target short URL with a payload placed in the Referer header. When an administrator opens admin/index.php?id=<shortcode> or when the public stats page is viewed, the payload executes in the YOURLS origin. The script can read admin DOM content, exfiltrate the API signature token, and issue authenticated same-origin requests.

php

// Patched signature clarifications in includes/functions-infos.php
// Source: https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7
 *
 * @param array $data  Array of 'data' => 'value'
 * @param int $limit   Optional limit list of X first countries
- * @param $size        Optional size of the image
- * @param $id          Optional HTML element ID
+ * @param int $size    Optional size of the image
+ * @param mixed $id    Optional HTML element ID
 * @return void
 */
function yourls_stats_pie($data, $limit = 10, $size = '340x220', $id = null) {

The full patch in Pull Request #4107 adds JavaScript-context escaping when building the chart data table.

Detection Methods for CVE-2026-63135

Indicators of Compromise

Rows in the YOURLS log table where the referrer column contains characters such as ', ", <, >, or the substring </script>.
Web server access logs showing requests to /{shortcode} with unusual, non-URL Referer header values.
Outbound requests from browser sessions of YOURLS administrators to attacker-controlled domains shortly after viewing yourls-infos.php.

Detection Strategies

Query the YOURLS database log table for referrer values containing HTML or JavaScript metacharacters and review the associated short URLs.
Inspect rendered statistics pages for chart labels that break out of expected domain-name formatting.
Correlate unauthenticated redirect hits against subsequent administrator visits to the corresponding stats page.

Monitoring Recommendations

Alert on HTTP requests to YOURLS short URLs where the Referer header contains script tags, quotes, or encoded payloads.
Monitor administrator browser telemetry for unexpected script execution or credential-bearing requests originating from the YOURLS origin.
Track any programmatic use of the YOURLS API signature token from unfamiliar IP addresses.

How to Mitigate CVE-2026-63135

Immediate Actions Required

Upgrade YOURLS to version 1.10.4 or later, available on the GitHub Release 1.10.4 page.
Purge or sanitize the existing referrer column in the YOURLS log table to remove poisoned entries.
Rotate the YOURLS API signature token and any admin credentials that may have been exposed to a compromised session.

Patch Information

The fix is delivered in commit e1e9347 via Pull Request #4107. Details are documented in GitHub Security Advisory GHSA-5h77-88j3-r659. The patch applies JavaScript-context escaping to chart labels before they are concatenated into inline scripts.

Workarounds

Restrict access to yourls-infos.php and disable public statistics pages until the upgrade is applied.
Deploy a web application firewall rule that strips or blocks Referer headers containing <, >, quote characters, or script tokens on requests to short URLs.
Apply a Content Security Policy on the YOURLS admin origin that forbids inline script execution to reduce impact of residual XSS.

bash

# Upgrade YOURLS to the patched release
cd /var/www/yourls
git fetch --tags
git checkout 1.10.4

# Optional: clear poisoned referrer entries (review before executing)
mysql -u yourls_user -p yourls_db -e \
  "UPDATE yourls_log SET referrer='direct' WHERE referrer REGEXP '[<>\"\\']';"