THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-5h77-88j3-r659 (high) — YOURLS has stored XSS in referrer statistics chart via crafted Referer header

[GHSA] GHSA-5h77-88j3-r659 (high) — YOURLS has stored XSS in referrer statistics chart via crafted Referer header

highgithub_advisoriesPublished 2026-08-21

GHSA-5h77-88j3-r659 Severity: high CVE: CVE-2026-63135

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

### Summary

YOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted `Referer` header to any existing short URL. When an authentica

MITRE ATT&CK techniques

IP AddressesT1590.005
JavaScriptT1059.007

Indicators of compromise

c3fc8e2370d240403c17c2e4a70e1e234759a5b3sha1
CVE-2026-63135cve
http://xurl
http://x\x27,1url

Original source: https://github.com/advisories/GHSA-5h77-88j3-r659