CVE-2026-54443
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In Dashy versions 1.9.4 through 3.2.0, the RSS widget does not sanitize RSS item link values before rendering them as href attributes in anchors. This allows an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin.
Risk Assessment
The risk is arbitrary JavaScript execution in the victim's browser within the Dashy origin, potentially leading to session theft, dashboard modification, or other actions on the user's account.
Recommendation
Immediately upgrade Dashy to version 3.2.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Dashy
See all- CVE-2026-46485High
Dashy before version 4.0.8 contains a vulnerability that allows unauthenticated users or non-admin authenticated users to write changes to the main config.yaml file through the config-saving functionality, despite configured permissions. This enables unauthorized modification of dashboard configuration and potential service disruption.
- CVE-2026-55592Low
A vulnerability in Dashy before version 4.3.7 allows JavaScript execution in the application's origin context by passing a malicious URL in the 'url' parameter of the workspace view. An attacker can exploit this to steal browser data, manipulate the DOM, or send requests on behalf of the victim.
Original NVD description (English source)
Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin. This issue is fixed in version 3.2.0.