CVE-2026-91146: Takahe XSS Vulnerability via JavaScript URIs

CVE-2026-91146 Overview

CVE-2026-91146 is a stored cross-site scripting (XSS) vulnerability in Takahe, an open-source ActivityPub server, affecting versions through 0.11.0. The flaw resides in the HTML sanitization logic in core/html.py, which fails to restrict URL schemes used in link href attributes within federated post content and profile summaries. Remote actors can inject javascript: URLs that execute in the origin of the receiving Takahe instance when a user clicks the link. Successful exploitation enables session hijacking, action impersonation, and manipulation of authenticated user context. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Federated content authored by an attacker on any remote instance can execute arbitrary JavaScript in the Takahe origin, permitting session hijacking and impersonation of any viewer who clicks the malicious link.

Affected Products

Takahe versions through 0.11.0
Takahe federated post rendering pipeline (core/html.py)
Takahe user profile summary rendering

Discovery Timeline

2026-09-14 - CVE-2026-91146 published to the National Vulnerability Database
2026-09-14 - Entry last modified in NVD

Technical Details for CVE-2026-91146

Vulnerability Analysis

Takahe federates content over ActivityPub, ingesting HTML fragments produced by remote instances and rendering them inside authenticated user sessions. The sanitizer in core/html.py strips certain tags and attributes but does not enforce an allowlist of safe URL schemes on <a href> values. Attackers craft a federated Note or profile summary containing an anchor whose href uses the javascript: pseudo-scheme. When a logged-in user clicks the link on a receiving Takahe instance, the script executes in the instance origin with access to cookies, CSRF tokens, and DOM state. This grants the attacker the ability to hijack sessions, perform actions on behalf of viewers, and pivot to further account takeover across the federated deployment.

Root Cause

The root cause is missing scheme validation during HTML sanitization of federated content. The sanitizer normalizes markup but omits an allowlist restricting href values to safe schemes such as http, https, and mailto. As a result, javascript: and other executable schemes propagate through federation and land in rendered pages. See GitHub Takahe Issue #728 and the Takahe html.py source for the vulnerable rendering path.

Attack Vector

Exploitation requires an attacker-controlled account on any federating ActivityPub server. The attacker publishes a post or updates a profile summary containing an anchor tag with a javascript: href, then federates it to a target Takahe instance by mention, follow, or reply. When an authenticated viewer clicks the rendered link, the browser executes the injected script in the Takahe origin. User interaction is required, but no authentication or elevated privileges are needed on the target instance. Refer to the VulnCheck Takahe XSS Advisory for advisory details.

No public proof-of-concept exploit code has been verified for this advisory. The vulnerability mechanism is a straightforward javascript: URL smuggled through federated HTML into rendered anchor elements.

Detection Methods for CVE-2026-91146

Indicators of Compromise

Federated posts or profile summaries stored in the Takahe database containing anchor tags with href values beginning with javascript:, data:, or vbscript:.
Outbound requests from user browsers to attacker-controlled domains immediately after rendering federated content.
Unexpected session activity, API calls, or profile modifications originating from authenticated users shortly after they view remote actor content.

Detection Strategies

Query the post and identity tables for stored HTML containing href="javascript: or URL-encoded variants such as href="j%61vascript:.
Deploy Content Security Policy reporting to capture and alert on inline script executions and blocked javascript: navigations.
Review reverse proxy and application logs for anomalous Referer chains where clicks on federated content immediately precede outbound cross-origin requests.

Monitoring Recommendations

Enable web server access logging with full URI and Referer capture on all Takahe front-ends.
Forward Takahe application logs and browser CSP violation reports to a centralized SIEM for correlation.
Alert on authenticated session tokens observed from new IP addresses or user agents within short time windows following exposure to remote federated content.

How to Mitigate CVE-2026-91146

Immediate Actions Required

Inventory all Takahe deployments and confirm running versions against 0.11.0 and earlier.
Upgrade to a fixed Takahe release once published by the maintainers; monitor the Takahe GitHub repository and issue #728 for release notes.
Enforce a strict Content Security Policy that disallows inline script execution and restricts script-src to trusted origins.
Rotate session cookies and invalidate active sessions if federated content from untrusted instances was rendered on a vulnerable version.

Patch Information

At the time of publication, the NVD entry references the vulnerable sanitizer in core/html.py at tag 0.11.0 and the tracking issue #728. Administrators should upgrade to the first Takahe release that enforces a URL scheme allowlist for anchor href attributes in federated HTML. Verify remediation by attempting to render a test post containing a javascript: link and confirming the scheme is stripped or neutralized.

Workarounds

Apply a reverse-proxy response filter or WAF rule that strips anchor tags whose href values do not begin with http:, https:, or mailto: before responses reach browsers.
Deploy a strict Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self' to block execution of injected inline scripts.
Restrict federation to a curated allowlist of trusted instances until the upstream fix is applied.
Communicate to users that clicking links inside federated posts and profile summaries can trigger script execution until the instance is patched.

bash

# Example Content Security Policy header to mitigate javascript: URL execution
# Add to reverse proxy (nginx) serving the Takahe instance
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;