EUVD-2026-42103Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Exploit delivery is a remotely-sent URL (AV:N); attacker requires no Dashy credentials (PR:N); victim must actively click the link (UI:R); impact is partial confidentiality and integrity within the Dashy origin only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.
AnalysisAI
Reflected XSS in Dashy's workspace view allows a remote attacker to execute arbitrary JavaScript in the victim's browser within the Dashy origin by tricking an authenticated user into visiting a crafted URL containing a javascript: scheme in the url query parameter. All Dashy releases prior to 4.3.7 are affected. Successful exploitation enables reading same-origin browser data, DOM manipulation, and issuing authenticated requests on behalf of the victim. No public exploit identified at time of analysis.
Technical ContextAI
Dashy (CPE: cpe:2.3:a:lissy93:dashy:*:*:*:*:*:*:*:*) is a self-hosted Vue.js-based personal dashboard application. The workspace view feature accepts a url query parameter and assigns it directly as the src attribute of an HTML iframe element without validating the URL scheme. This constitutes a CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw - specifically a javascript: URL injection. When a browser processes an iframe with src set to a javascript: URL, the script executes in the parent document's origin context, granting it full same-origin access to Dashy's DOM, cookies, localStorage, and the ability to issue credentialed HTTP requests. The vulnerable workspace url parameter is part of the default Dashy feature set and requires no special server-side configuration to be present.
RemediationAI
Upgrade Dashy to version 4.3.7, which patches the vulnerability by adding scheme validation to the url query parameter before it is assigned as the iframe src attribute; the release is available at https://github.com/lissy93/dashy/releases/tag/4.3.7. If an immediate upgrade is not feasible, operators should restrict access to the Dashy instance to trusted networks only - for example, placing it behind a VPN or firewall that blocks unauthenticated external reach, which removes the attacker's ability to deliver a crafted link to an accessible target. As an additional compensating control, configuring a Content Security Policy header at the reverse proxy layer that restricts frame-src to https: or self will block javascript: URL execution in iframes; note this may break legitimate iframe embedding of non-HTTPS resources. Users should also be advised not to click Dashy workspace links received from external or untrusted sources until the patch is applied.
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. Rated medium severity (CVSS 4.3), this vul
Unauthorized configuration write in Dashy self-hosted dashboard (versions prior to 4.0.8) lets unauthenticated users or
Stored XSS via unsanitized `javascript:` URI injection in the Dashy RSS Feed widget (src/components/Widgets/RssFeed.vue)
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today