TI-2026-45071 Aliases CVE-2026-63135 GHSA-5h77-88j3-r659

YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

HIGH 69CWE-79Published 2026-08-21 · Updated 2026-08-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00425 37th percentileScored 2026-11-07

Fix Fixed YOURLS (YOURLS): 1.10.4yourls/yourls (Packagist): 1.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
yourls	YOURLS	1.5.1 to before 1.10.4	1.10.4	Patch available	CNA
—	yourls/yourls (Packagist)	1.5.1 to before 1.10.4	1.10.4	Patch available	GHSA-5h77-88j3-r659

YOURLS Vendoryourls Affected 1.5.1 to before 1.10.4 Fixed in 1.10.4 Patch available CNA
yourls/yourls (Packagist) Vendor— Affected 1.5.1 to before 1.10.4 Fixed in 1.10.4 Patch available GHSA-5h77-88j3-r659

Remediation

Fix · CNA YOURLS (YOURLS) Fixed in 1.10.4
Fix · GHSA-5h77-88j3-r659 yourls/yourls (Packagist) Fixed in 1.10.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-63135
2026-10-03 Alias added: GHSA-5h77-88j3-r659

References

Other 5

TI-2026-74003 Unauthenticated file inclusion in YOURLS executes local PHP files CVSS 3.1MEDIUM 5.3
TI-2019-10834 YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass. CVSS 3.0CRITICAL 9.8
TI-2021-02667 Improper Restriction of Rendered UI Layers or Frames in yourls/yourls CVSS 3.1HIGH 8.8
TI-2022-00039 Cross-Site Request Forgery (CSRF) in yourls/yourls CVSS 3.1HIGH 7.4
TI-2021-02714 Cross-site Scripting (XSS) - Reflected in yourls/yourls CVSS 3.1MEDIUM 6.1
TI-2021-02716 Cross-site Scripting (XSS) - Stored in yourls/yourls CVSS 3.1MEDIUM 5.4

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences