CyberRota Analysis
AI-GeneratedThe Dashy RSS Widget in versions 1.9.4 to 3.2.0 is vulnerable due to improper sanitization of RSS item link values, which can allow attackers to inject malicious JavaScript via crafted feed links. This vulnerability poses a risk of executing arbitrary scripts in the context of the Dashy application, potentially leading to data theft or unauthorized actions. Users running affected versions, particularly those managing personal dashboards or sensitive information, should prioritize upgrading to version 3.2.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.