What is the CVSS score of CVE-2026-23768?

CVE-2026-23768 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Lucy Xss Filter are affected by CVE-2026-23768?

Organizations using lucy-xss-filter before commit 7c1de6d should be aware of moderate risk from CVE-2026-23768, a server-side request forgery vulnerability rated CVSS 6.1.

Is there a public PoC exploit available for CVE-2026-23768?

Yes, a public proof-of-concept exploit is available for CVE-2026-23768. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23768?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Lucy Xss Filter CVE-2026-23768

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-01-16 cve@navercorp.com

XSS SSRF Lucy Xss Filter Naver

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 23, 2026 - 17:26 vuln.today

Public exploit code

CVE Published

Jan 16, 2026 - 06:15 nvd

MEDIUM 6.1

DescriptionCVE.org

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.

AnalysisAI

Lucy XSS Filter with ObjectSecurityListener or EmbedSecurityListener enabled is vulnerable to server-side request forgery (SSRF) via malformed embed or object tags lacking file extensions in src attributes, allowing remote attackers to trigger arbitrary HEAD requests to internal or external URLs. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Lucy-Xss-Filter. lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.