CVE-2026-68583

MediumCVSS 5.4

Published: 02/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 02/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

luci-app-adblock-fast before version 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field. Lower-privileged users can inject active HTML, which executes in the administrator's browser when viewing the AdBlock Fast status page, under the LuCI origin.

Risk Assessment

An attacker with lower privileges can execute arbitrary JavaScript in the administrator's browser, potentially leading to session theft, configuration changes, or further privilege escalation.

Recommendation

Update luci-app-adblock-fast to version 1.2.4-4 or later. Restrict access to the LuCI admin panel to trusted users only.

Other vulnerabilities in luci-app-adblock-fast

CVE-2026-55159High
luci-app-adblock-fast for OpenWrt prior to 1.2.4-2 allowed the luci.adblock-fast.setCronEntry RPC method to accept an entry argument containing carriage-return or line-feed characters and serialize it into /etc/crontabs/root as one logical line. An authenticated delegated user with the write ACL could create an additional root cron entry, resulting in persistent command execution as UID 0.

Original NVD description (English source)

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS