https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T00:19:40.577617+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-63135 fkie_cve-2026-63135 2026-10-10T00:19:41.280383+00:00

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

 https://vulnerability.circl.lu/vuln/ghsa-5h77-88j3-r659 GHSA-5h77-88j3-r659 — YOURLS has stored XSS in referrer statistics chart via crafted Referer header 2026-10-10T00:19:41.280476+00:00

Affected: Packagist: yourls/yourls

### Summary

YOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted `Referer` header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting.

This is reachable in default private installations when authenticated users view stats, and in documented configurations where `YOURLS_PRIVATE_INFOS` is set to `false` to make statistics pages public.

### Details

The vulnerable source-to-sink path is:

```text HTTP Referer header -> yourls_get_referrer() -> yourls_sanitize_url_safe() -> yourls_log_redirect() -> log table referrer column -> yourls-infos.php referrer aggregation -> yourls_get_domain() -> yourls_stats_pie() -> yourls_google_array_to_data_table() -> inline JavaScript ```

Relevant code:

- `includes/functions.php:240-243`: `yourls_get_referrer()` reads `$_SERVER['HTTP_REFERER']`, calls `yourls_sanitize_url_safe()`, and truncates the result to 200 bytes. - `includes/functions.php:294-307`: `yourls_redirect_shorturl()` calls `yourls_log_redirect()` before redirecting the visitor. - `includes/functions.php:516-545`: `yourls_log_redirect()` stores the sanitized referrer in the log table. - `yourls-infos.php:60-82`: the stati…