Misskey CVE-2026-46714

Active user interaction is a hard prerequisite: the victim must deliberately select and apply the malicious theme within the Misskey web client (UI:A per the provided CVSS 4.0 vector). The attacker requires no authentication to craft the theme (PR:N) but must deliver it to the victim through social engineering, theme sharing features, or federated content. Impact is strictly client-side - the Misskey server is unaffected, and there is no confidentiality or integrity consequence. Exploitation is further limited to Misskey installations running versions 8.63.0 through pre-2026.5.4; versions outside this range are not affected per the CVE description. Non-default conditions that expand risk: any Misskey deployment permitting users to freely import external themes increases the attack surface.

The CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A places this as low-complexity and network-reachable, but active user interaction (UI:A) is a hard prerequisite - the victim must deliberately apply the malicious theme. The provided vector records VA:N (no availability impact on the Misskey application itself) and SA:L (low availability impact on the subsequent/browser system), an unusual distribution that suggests the scoring treats the browser environment as the downstream impacted system rather than the Misskey server. No confidentiality or integrity impact is recorded in either system. No EPSS score was provided in the input; KEV status is absent, meaning active exploitation is not confirmed. The attack is not automatable at scale - social engineering is required to induce the victim action, significantly limiting real-world exploitation breadth. Overall, this is a low-priority issue in practice: high CVSS accessibility metrics are tempered by mandatory user interaction and an impact ceiling of a client browser crash.

An attacker constructs a Misskey theme file containing deeply nested or self-referential structures designed to exhaust the client-side JavaScript recursion limit in the theme processor. The attacker distributes this theme through the Misskey platform, federated instances, or social channels targeting Misskey users. When a victim user applies the theme from within their Misskey web client, the browser tab consumes excessive CPU or hits a call stack limit, rendering the client unresponsive or forcing a crash with no data loss or server-side effect.