Misskey EUVD-2026-99238

Exploitation requires that a Misskey user (versions 12.0.0 up to 2026.7.0) has an RSS widget, RSS ticker widget, or RSS status bar configured to consume a feed whose item content the attacker controls or can inject into, AND that the user actively clicks a feed-item link crafted with an unsafe scheme (e.g. javascript:). The pre-patch code failed to restrict link protocols to http:/https: before rendering, so a javascript: link executes on click. Limiting factors: active user interaction is mandatory (CVSS UI:A - no execution without a click), the attacker must influence feed content trusted by the victim, and an RSS widget must be in use, so default installs without configured RSS feeds are not exposed. The flaw is fully fixed in 2026.7.0.

This is a client-side DOM XSS (CWE-79) in Misskey's RSS widgets (WidgetRss, WidgetRssTicker, statusbar-rss). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N, score 8.5 HIGH) is network-reachable with low complexity and no privileges, but critically requires active user interaction (UI:A) - the victim must click a malicious feed-item link. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; this is NOT confirmed active exploitation. The practical risk is tempered by two real-world preconditions not captured by the headline score: the attacker must control the content of an RSS feed that a victim has configured into a widget, and the victim must then click the crafted link. The source-code evidence confirms the flaw is genuine - the patched code wraps URL parsing in tryParseUrl() and gates rendering on ['http:','https:'].includes(protocol), blocking javascript:/data: schemes. Net assessment: a legitimate, well-documented client-side XSS worth patching, but the interaction requirement and feed-control precondition make it opportunistic/targeted rather than a mass-exploitation priority. No conflicting signals in the data; the main gap is absent EPSS/KEV/POC telemetry.

An attacker publishes or compromises an RSS feed that a Misskey user has added to an RSS widget or status bar, and injects a feed item whose link uses an unsafe scheme such as javascript:. When the victim clicks that item link in the rendered RSS widget, the script executes in the victim's authenticated Misskey session. No public exploit code was identified in the provided data, but the vendor patch and advisory confirm the underlying defect.