ka9q_ubersdr CVE-2026-97723

Exploitation requires a running ka9q_ubersdr instance before version 0.1.58 with the chat feature in use, and the ability to submit a chat message that is stored and later rendered to other users. The attacker embeds a URL containing quotation characters so the linkified href attribute breaks out and injects attacker-controlled HTML/JS; delivery is passive because rendering alone triggers execution (no victim click, per the description). Limiting factors: the target must be an unpatched instance whose chat is reachable to the attacker, and a second user must view the chat for impact to occur; if the instance restricts chat to authenticated users, effective privilege rises to PR:L. Impact is confined to client-side script execution in viewers' browsers, not the server.

This is a genuine but modest-severity stored XSS (CWE-79) in the chat rendering of ka9q_ubersdr, a niche hobbyist KA9Q-based web SDR interface. The vendor/NVD CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N = 5.4) is internally consistent with a stored XSS: network-reachable, no privileges asserted, no victim click required (UI:N, confirmed by the description's 'No click on the malicious link was required'), scope change into the victim's browser context (S:C), and limited confidentiality/integrity impact (C:L/I:L). I would rate complexity lower than the vendor's AC:H - breaking out of an href with a quotation character is a well-understood, reliable technique, so AC:L (~6.1) is more defensible; the AC:H choice appears conservative rather than justified. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. The only impact ceiling is that the flaw yields client-side script execution (session/UI manipulation of other viewers), not server compromise. Net: a real, patch-worthy bug but a low real-world priority given the tiny deployment footprint and absence of exploitation signals. Note one ambiguity: PR:N assumes chat posting is open to unauthenticated users; if the SDR instance gates chat behind a login, effective privilege would be PR:L - verify against deployment.

An attacker connected to a vulnerable ka9q_ubersdr web SDR instance posts a chat message containing a crafted URL whose quotation characters break out of the generated <a href="..."> attribute and inject additional HTML attributes carrying JavaScript. When any other user's browser later renders the stored message, the script executes automatically with no click required. No public exploit code is identified, but the patched linkifyUrls diff makes the payload construction straightforward.