Read the docs
TI-2023-10616 Aliases CVE-2023-25154

Cross site scripting (XSS) of ActivityPub URI in misskey

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execute JavaScript code in the context of the recipient. This issue has been fixed in version 13.5.0. Users are advised to upgrade. Users unable to upgrade should not "view on remote" for untrusted instances.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00429 37th percentileScored 2026-11-07
Fix Fixed misskey (misskey-dev): 13.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
misskey-devmisskeybefore 13.5.013.5.0Patch availableCNA
  • misskey Vendormisskey-dev Affected before 13.5.0 Fixed in 13.5.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:*before 13.5.0Vulnerablemisskey-dev
  • cpe:2.3:a:misskey:misskey:*:*:*:*:*:*:*:* Versions before 13.5.0 Vulnerable ·misskey-dev

Remediation

  • Fix · CNA misskey (misskey-dev) Fixed in 13.5.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25154

References

Advisory 1

  • TI-2025-18599 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes CVSS 3.1HIGH 8.2
  • TI-2025-29081 Misskey CSS Style Injection Vulnerability In `MkUrlPreview` CVSS 3.1HIGH 7.2
  • TI-2025-40906 Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVSS 4.0MEDIUM 6.9
  • TI-2025-29276 Misskey Directory Traversal Vulnerability in AiScript via `Mk:api` CVSS 3.1HIGH 7.5
  • TI-2025-40839 misskey.js's export data contains private post data CVSS 4.0HIGH 7.1
  • TI-2026-22705 Misskey lacks proper authorization checks and input validation CVSS 4.0CRITICAL 9.2
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences