luci-app-https-dns-proxy vulnerabilities

3 known CVE vulnerabilities in luci-app-https-dns-proxy, translated and rated.

CVE-2026-46368High
Command injection vulnerability in luci-app-https-dns-proxy for OpenWrt. An authenticated user with appropriate permissions can inject shell metacharacters via the 'name' parameter in a ubus RPC call, leading to arbitrary command execution as root.
CVE-2026-26899High
In luci-app-https-dns-proxy on OpenWrt (PR #15, before 2026-01-17), the setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter.
CVE-2026-67352High
A stored XSS vulnerability in luci-app-https-dns-proxy allows authenticated users to inject active HTML via the resolver_url parameter. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS