TI-2026-61907 CVE-2026-91146 · GHSA-p8xj-r4q8-q652
Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
Priority LOW 24
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links.