CVE-2026-68583: luci-app-adblock-fast XSS Vulnerability

CVE-2026-68583 Overview

CVE-2026-68583 is a stored cross-site scripting (XSS) vulnerability in luci-app-adblock-fast versions before 1.2.4-4. The flaw resides in the blocklist name field, which fails to sanitize user-supplied input before rendering it on the AdBlock Fast status page. Lower-privileged users can inject active HTML that executes in an administrator's browser under the LuCI origin when the status page is viewed. Successful exploitation allows attackers to run arbitrary script content within an authenticated administrator session on OpenWrt devices. The vulnerability is tracked as CWE-79.

Critical Impact
An attacker with low privileges can execute arbitrary JavaScript in the administrator's browser context, enabling session abuse and unauthorized configuration changes on OpenWrt routers.

Affected Products

OpenWrt LuCI luci-app-adblock-fast package
Versions before 1.2.4-4
Deployments exposing the LuCI web interface with multi-user privilege separation

Discovery Timeline

2026-08-02 - CVE-2026-68583 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-68583

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the luci-app-adblock-fast component of the OpenWrt LuCI web interface. The blocklist name field accepts user input without applying proper output encoding when the value is rendered on the AdBlock Fast status page. As a result, HTML markup and JavaScript payloads supplied by a lower-privileged user persist in the application state and execute when an administrator visits the affected page.

Because the injected script runs under the LuCI origin, it inherits the administrator's session context. This enables an attacker to issue authenticated requests, modify router configuration, exfiltrate credentials handled in the LuCI UI, or pivot toward network-level abuse. The attack requires user interaction from the administrator, since the payload only fires when the status page is loaded.

Root Cause

The root cause is missing output sanitization of the blocklist name string before it is embedded into the HTML response for the status page. LuCI templating rendered the untrusted value as active markup rather than escaping characters such as <, >, and ". This is a classic instance of CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

An authenticated user with permission to add or modify blocklist entries submits a malicious name value containing HTML or JavaScript. The value is stored in the AdBlock Fast configuration. When an administrator subsequently views the AdBlock Fast status page, the LuCI server returns the unsanitized markup and the browser executes the payload in the administrator context. Refer to the GitHub Security Advisory GHSA-q335-4c83-c88h and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-68583

Indicators of Compromise

Blocklist name entries in AdBlock Fast configuration containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=.
Unexpected outbound HTTP requests originating from administrator browsers immediately after visiting the LuCI AdBlock Fast status page.
LuCI configuration changes that occur without a corresponding administrator-initiated action, such as new users, altered firewall rules, or modified DNS settings.

Detection Strategies

Inspect the /etc/config/adblock-fast file and related UCI configuration entries for blocklist name fields containing HTML metacharacters or script keywords.
Review LuCI access logs for POST requests to blocklist management endpoints originating from non-administrator accounts.
Compare installed luci-app-adblock-fast package versions against 1.2.4-4 using opkg list-installed | grep adblock-fast.

Monitoring Recommendations

Enable web request logging on the OpenWrt device and forward LuCI access logs to a central log store for review.
Alert on administrator session activity that originates from unusual referrers or that includes unexpected JavaScript-driven POSTs to LuCI RPC endpoints.
Track configuration deltas on OpenWrt devices to identify unauthorized changes that may follow successful XSS execution.

How to Mitigate CVE-2026-68583

Immediate Actions Required

Upgrade luci-app-adblock-fast to version 1.2.4-4 or later on all OpenWrt devices running the package.
Audit existing blocklist entries and remove any names containing HTML markup or script content before administrators visit the status page.
Restrict LuCI accounts so that only trusted users can add or modify AdBlock Fast blocklist configuration.

Patch Information

The fix is available in luci-app-adblock-fast version 1.2.4-4. Update the package using the OpenWrt package manager after refreshing the package index. Details are published in the OpenWrt LuCI GitHub Security Advisory.

Workarounds

Remove the luci-app-adblock-fast package until an upgrade can be applied if the AdBlock Fast UI is not required.
Limit LuCI access to a single administrative account, eliminating the lower-privileged user path required for exploitation.
Restrict LuCI to trusted management networks using firewall rules to reduce exposure of the vulnerable interface.

bash

# Configuration example
opkg update
opkg upgrade luci-app-adblock-fast
opkg list-installed | grep adblock-fast