Description
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, enabling session hijacking or impersonation of viewers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jointakahe | takahe | ≤ 0.11.0 | — |
References
- GitHub Issue #728 issue-tracking
- https://github.com/jointakahe/takahe product
- core/html.py at 0.11.0 technical-description
- VulnCheck Advisory: Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme third-party-advisory