Dashy vulnerabilities

In Dashy versions 1.9.4 through 3.2.0, the RSS widget does not sanitize RSS item link values before rendering them as href attributes in anchors. This allows an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin.

Dashy before version 4.0.8 contains a vulnerability that allows unauthenticated users or non-admin authenticated users to write changes to the main config.yaml file through the config-saving functionality, despite configured permissions. This enables unauthorized modification of dashboard configuration and potential service disruption.

A vulnerability in Dashy before version 4.3.7 allows JavaScript execution in the application's origin context by passing a malicious URL in the 'url' parameter of the workspace view. An attacker can exploit this to steal browser data, manipulate the DOM, or send requests on behalf of the victim.