What is the CVSS score of CVE-2026-23768?

CVE-2026-23768 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Lucy Xss Filter are affected by CVE-2026-23768?

Organizations using lucy-xss-filter before commit 7c1de6d should be aware of moderate risk from CVE-2026-23768, a server-side request forgery vulnerability rated CVSS 6.1.

Is there a public PoC exploit available for CVE-2026-23768?

Yes, a public proof-of-concept exploit is available for CVE-2026-23768. Prioritise patching immediately. EPSS: 0.0%.

Lucy Xss Filter CVE-2026-23768

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-01-16 cve@navercorp.com

SSRF XSS Lucy Xss Filter

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 23, 2026 - 17:26 vuln.today

Public exploit code

CVE Published

Jan 16, 2026 - 06:15 nvd

MEDIUM 6.1

DescriptionCVE.org

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.

AnalysisAI

Lucy XSS Filter with ObjectSecurityListener or EmbedSecurityListener enabled is vulnerable to server-side request forgery (SSRF) via malformed embed or object tags lacking file extensions in src attributes, allowing remote attackers to trigger arbitrary HEAD requests to internal or external URLs. Public exploit code exists for this vulnerability, and no patch is currently available.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	CVSS 6.1 (MEDIUM). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListen.
Remediation	Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-23768 vulnerability details – vuln.today

Back