CVE-2026-55592
LowCVSS 3.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in Dashy before version 4.3.7 allows JavaScript execution in the application's origin context by passing a malicious URL in the 'url' parameter of the workspace view. An attacker can exploit this to steal browser data, manipulate the DOM, or send requests on behalf of the victim.
Risk Assessment
The risk includes session hijacking, theft of sensitive data stored in the browser, and unauthorized actions on the victim's account, potentially leading to data security breaches in the organization.
Recommendation
Immediately update Dashy to version 4.3.7 or later, which includes a fix for URL scheme validation in the 'url' parameter.
Other vulnerabilities in Dashy
See all- CVE-2026-54443Medium
In Dashy versions 1.9.4 through 3.2.0, the RSS widget does not sanitize RSS item link values before rendering them as href attributes in anchors. This allows an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin.
- CVE-2026-46485High
Dashy before version 4.0.8 contains a vulnerability that allows unauthenticated users or non-admin authenticated users to write changes to the main config.yaml file through the config-saving functionality, despite configured permissions. This enables unauthorized modification of dashboard configuration and potential service disruption.
Original NVD description (English source)
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS