CVE-2026-67352
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A stored XSS vulnerability in luci-app-https-dns-proxy allows authenticated users to inject active HTML via the resolver_url parameter. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
Risk Assessment
An attacker can hijack the administrator's session, steal credentials, or perform unauthorized actions in the admin panel.
Recommendation
Update luci-app-https-dns-proxy to the latest version that fixes the XSS vulnerability.
Other vulnerabilities in luci-app-https-dns-proxy
See all- CVE-2026-26899Unknown
In luci-app-https-dns-proxy on OpenWrt (PR #15, before 2026-01-17), the setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter.
- CVE-2026-46368High
Command injection vulnerability in luci-app-https-dns-proxy for OpenWrt. An authenticated user with appropriate permissions can inject shell metacharacters via the 'name' parameter in a ubus RPC call, leading to arbitrary command execution as root.
Original NVD description (English source)
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.