EUVD-2026-44760Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feed-control prerequisite justifies AC:H; no Dashy privileges needed (PR:N); user click required (UI:R); javascript: executes in Dashy origin causing scope change (S:C) with session-level confidentiality impact (C:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.
AnalysisAI
Stored XSS via unsanitized javascript: URI injection in the Dashy RSS Feed widget (src/components/Widgets/RssFeed.vue) affects all releases from 1.9.4 through 3.1.x, allowing an attacker who controls an RSS feed source configured in the dashboard to deliver a malicious anchor href that executes arbitrary JavaScript in the Dashy origin when a user clicks it. The attack requires both feed-source control and user interaction, and is confined to the Dashy application origin - meaning session tokens, cookies, or dashboard credentials are the primary targets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 3.2.0.
Technical ContextAI
Dashy is a Vue.js-based self-hosted personal dashboard (CPE: cpe:2.3:a:lissy93:dashy:*:*:*:*:*:*:*:*). The vulnerable component, src/components/Widgets/RssFeed.vue, fetches user-configured RSS feeds and renders item links as raw anchor href attributes without validating or sanitizing the URI scheme. CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page - Basic XSS) describes this root cause: the application trusts feed-supplied content and writes it directly into the DOM as a href value. Modern browsers permit javascript: as a valid URI scheme in anchor elements and execute the URI payload synchronously in the page's scripting context when the link is activated. Because Dashy runs as a single-page application in the user's browser, successful execution grants the payload access to the full Dashy origin - including session storage, cookies, and any authenticated API calls the dashboard can make.
RemediationAI
Vendor-released patch: version 3.2.0. Upgrade to Dashy 3.2.0 immediately; the release is available at https://github.com/lissy93/dashy/releases/tag/3.2.0 and the fix addresses href sanitization in the RSS Feed widget. For deployments that cannot upgrade immediately, the most effective compensating control is to remove or disable any RSS Feed widgets that consume externally-hosted feeds, replacing them only with feeds served from internally-controlled infrastructure - this eliminates the attacker-controlled feed prerequisite entirely, though it reduces dashboard functionality. Alternatively, restricting the Dashy instance to trusted, authenticated users (e.g., behind VPN or SSO) limits the blast radius of any successful XSS by reducing the value of stolen session tokens. Note that browser-level Content Security Policy headers, if configurable via a reverse proxy in front of Dashy, can block javascript: URI execution as an additional layer, though this is a defense-in-depth measure rather than a primary fix.
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. Rated medium severity (CVSS 4.3), this vul
Unauthorized configuration write in Dashy self-hosted dashboard (versions prior to 4.0.8) lets unauthenticated users or
Reflected XSS in Dashy's workspace view allows a remote attacker to execute arbitrary JavaScript in the victim's browser
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today