Is there a patch available for CVE-2026-46714?

Yes, a patch is available for CVE-2026-46714. Update the affected software to the latest version immediately.

Misskey CVE-2026-46714

Q: What is the CVSS score of CVE-2026-46714?

CVE-2026-46714 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52489 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-08-03 GitHub_M

Denial Of Service Misskey Misskey Dev

5.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

User must actively apply the theme (UI:R); impact is client-side browser availability only (A:L); no server scope change, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 03, 2026 - 23:02 EUVD

Source Code Evidence Fetched

Aug 03, 2026 - 22:32 vuln.today

Analysis Generated

Aug 03, 2026 - 22:32 vuln.today

DescriptionCVE.org

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4.

AnalysisAI

Malformed theme application in the Misskey web client (versions 8.63.0 through pre-2026.5.4) triggers uncontrolled recursion (CWE-674), causing the browser client to slow down significantly or crash entirely. Unauthenticated network-reachable attackers can craft and distribute a malicious theme that, when applied by a victim user, produces a client-side denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV; active exploitation is not confirmed.

Technical ContextAI

Misskey is an open-source, federated social media platform built on the ActivityPub protocol, with a JavaScript-based web client that supports customizable visual themes. The affected component is the client-side theme parser and applicator, which processes theme definitions submitted by users or loaded from external sources. CWE-674 (Uncontrolled Recursion) as the root cause class indicates the theme processing logic contains recursive routines that lack adequate depth limits, cycle detection, or input validation against pathological nesting. A malformed theme can cause the JavaScript engine to exhaust its call stack or spin consuming CPU/memory until the browser tab crashes or becomes unresponsive. The CPE cpe:2.3:a:misskey-dev:misskey:*:*:*:*:*:*:*:* covers the full product; the affected range is 8.63.0 through (exclusive) 2026.5.4.

RemediationAI

Upgrade Misskey to version 2026.5.4 or later, which is confirmed by release notes at https://github.com/misskey-dev/misskey/releases/tag/2026.5.4 to include the fix for GHSA-wmhf-m93m-rgmj (CVE-2026-46714). For operators who cannot immediately upgrade, a practical compensating control is to restrict or disable the ability for untrusted users to import or apply externally sourced custom themes via platform moderation settings or access controls - this eliminates the attack delivery vector at the cost of restricting legitimate theme customization. User-facing guidance to apply themes only from trusted, vetted sources reduces social-engineering risk without configuration change. No workaround fully eliminates the underlying parser defect; upgrading remains the only complete fix. The full advisory is at https://github.com/misskey-dev/misskey/security/advisories/GHSA-wmhf-m93m-rgmj.