CVE-2026-23768

MEDIO 6.1CVE-2026-23768 · Published 16/01/2026 · updated 17/06/2026

In breve

CVE-2026-23768 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda lucy-xss-filter (naver).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.24%, superiore al 15.2% delle vulnerabilità.
Correzione: aggiornare a 2025-06-08 o successiva.

Package	Affected versions	Patched versions
lucy-xss-filter naver	`< 2025-06-08`	`2025-06-08`

Description

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.

References

cve.naver.com/detail/cve-2026-23768.html · Vendor Advisory
naver/lucy-xss-filter#31 · Exploit

Altre vulnerabilità di lucy-xss-filter

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free