Is there a patch available for CVE-2026-68583?

Yes, a patch is available for CVE-2026-68583. Update the affected software to the latest version immediately.

luci-app-adblock-fast CVE-2026-68583

Q: What is the CVSS score of CVE-2026-68583?

CVE-2026-68583 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-51993 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-02 VulnCheck

GHSA-vh6j-2jxw-848c

XSS Luci

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible stored XSS requires low-privileged account (PR:L) and admin page visit (UI:R); scope changes (S:C) because payload executes in admin browser context with LuCI origin access.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 02, 2026 - 13:07 vuln.today

Patch available

Aug 02, 2026 - 13:01 EUVD

DescriptionCVE.org

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.

AnalysisAI

Stored cross-site scripting in luci-app-adblock-fast before 1.2.4-4 allows a lower-privileged LuCI user to inject malicious JavaScript into the blocklist name field, which executes in an administrator's browser under the LuCI origin when the AdBlock Fast status page is viewed. Because the payload runs within the LuCI same-origin context, a successful attack could enable session hijacking, unauthorized router reconfiguration, or privilege escalation from low-privileged user to effective admin control. No public exploit is identified at time of analysis; a vendor patch is available via the GitHub Security Advisory GHSA-q335-4c83-c88h.

Technical ContextAI

LuCI is the standard web administration interface for OpenWrt-based routers and embedded Linux devices. The affected component, luci-app-adblock-fast, is a LuCI plugin managing ad-blocking rules via blocklist configurations. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input in the blocklist name field is stored without sanitization and later rendered into the admin status page without output encoding, allowing active HTML and JavaScript injection. The CPE cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:* confirms the vulnerability spans all LuCI versions shipping luci-app-adblock-fast prior to 1.2.4-4. The attack surface is the LuCI HTTP interface, typically exposed on the router's LAN-side network.

RemediationAI

Upgrade luci-app-adblock-fast to version 1.2.4-4 or later, which contains the vendor-confirmed fix per the GitHub Security Advisory at https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h. On OpenWrt devices, this can typically be performed via opkg: run 'opkg update && opkg upgrade luci-app-adblock-fast'. If immediate patching is not possible, restrict LuCI access to the minimum required accounts - remove or disable any lower-privileged user accounts that do not require access to the blocklist configuration, since the attack requires an authenticated low-privileged session. As an additional compensating control, restrict the LuCI interface to trusted LAN segments or VPN-only access to limit the pool of potential attackers. Before patching, audit existing blocklist name entries for suspicious script tags or encoded payloads and remove any anomalies.