CVE-2026-55592
LowCVSS 3.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in Dashy before version 4.3.7 allows JavaScript execution in the application's origin context by passing a malicious URL in the 'url' parameter of the workspace view. An attacker can exploit this to steal browser data, manipulate the DOM, or send requests on behalf of the victim.
Risk Assessment
The risk includes session hijacking, theft of sensitive data stored in the browser, and unauthorized actions on the victim's account, potentially leading to data security breaches in the organization.
Recommendation
Immediately update Dashy to version 4.3.7 or later, which includes a fix for URL scheme validation in the 'url' parameter.
Original NVD description (English source)
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.