CVE-2025-46553

CVE-2025-46553 (Misskey summaly) : A logic error in the main summaly function (versions 3.0.1 to before 5.2.1) causes the allowRedirects option to be omitted when passed to plugins, so redirects are followed despite explicit requests not to. This creates a Redirect Filter Bypass condition and can...

GHSA-7899-W6C4-VQC4 @misskey-dev/summaly Redirect Filter Bypass

Summary A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Details In the main summaly function, a new scrapingOptions object is created and passed to either the matched plugin, if any, or the default...

@misskey-dev/summaly Redirect Filter Bypass

Summary A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Details In the main summaly function, a new scrapingOptions object is created and passed to either the matched plugin, if any, or the default...

PT-2025-19770 · Npm · @Misskey-Dev/Summaly

Name of the Vulnerable Software and Affected Versions: @misskey-dev/summaly versions 3.0.1 through 5.2.0 Description: A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. This issue allows Misskey to follow...

PT-2025-19771 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.31.0 through 2025.4.0 Description: The issue is related to missing validation in Mk:api, which allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. This is achieved by...

Misskey 安全漏洞

Misskey is a perpetually free open source syndicated social media platform from Misskey Open Source. A security vulnerability exists in Misskey versions prior to 12.0.0 through 2025.4.1, which stems from insufficient validation of UrlPreviewService and MkUrlPreview, and could lead to CSS injectio...

PT-2025-19769 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.0.0 through 2025.4.0 Description: The issue arises from an oversight in validation performed in UrlPreviewService and MkUrlPreview, allowing an attacker to inject arbitrary CSS into the MkUrlPreview component. This can lea...

Misskey 路径遍历漏洞

Misskey is a perpetually free open source federated social media platform from Misskey Open Source. A path traversal vulnerability exists in Misskey versions prior to 12.31.0 through 2025.4.1, which stems from insufficient Mk:api authentication and could lead to unauthorized access to endpoints...

CVE-2025-25306

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub...

CVE-2025-25306

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub...

CVE-2025-25306

Misskey CVE-2025-25306 concerns insufficient validation of the relation between the id and url fields in ActivityPub objects, allowing forging of objects and potential authenticity claims across instances. Affected version is before 2025.2.1, with the issue addressed in 2025.2.1. Concrete technic...

CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub...

CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub...

CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the id and url fields of ActivityPub objects. An attacker can forge an object where they claim authority in the url field even if the specific ActivityPub...

Misskey 安全漏洞

Misskey is a perpetually free open source syndicated social media platform from Misskey Open Source. A security vulnerability exists in Misskey versions prior to 2025.2.1 that stems from insufficient validation of the relationship between the id and url fields of an ActivityPub object, which coul...

CVE-2025-24897

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

CVE-2025-24896

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary...

CVE-2025-24896

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary...

CVE-2025-24897

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

CVE-2025-24897 Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...