CVE-2023-25154 HIGH

CVE-2023-25154: Cross site scripting (XSS) of ActivityPub URI in misskey

Vendor Misskey-Dev
Product misskey
Weakness CWE-79 · XSS
Published February 22, 2023
Last update March 10, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execute JavaScript code in the context of the recipient. This issue has been fixed in version 13.5.0. Users are advised to upgrade. Users unable to upgrade should not "view on remote" for untrusted instances.

Key dates

02Disclosure timeline

February 22, 2023 CVE published
March 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-32454 WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-22595 WordPress Mailing Group Listserv Plugin <= 2.0.9 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-3469 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq CVE-2025-46952 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-55106 BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.