luci-app-https-dns-proxy vulnerabilities
3 known CVE vulnerabilities in luci-app-https-dns-proxy, translated and rated.
- CVE-2026-26899Unknown
In luci-app-https-dns-proxy on OpenWrt (PR #15, before 2026-01-17), the setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter.
- CVE-2026-46368High
Command injection vulnerability in luci-app-https-dns-proxy for OpenWrt. An authenticated user with appropriate permissions can inject shell metacharacters via the 'name' parameter in a ubus RPC call, leading to arbitrary command execution as root.
- CVE-2026-67352High
A stored XSS vulnerability in luci-app-https-dns-proxy allows authenticated users to inject active HTML via the resolver_url parameter. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.