PT-2025-6244 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.109.0 through 2025.2.0-alpha.0 Description: Misskey is an open source, federated social media platform. Due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the currentqueue portion of the path on the /queues endpoint. An attacker can manipulate the output of the web page by injecting malicious scripts into the URL path. Details Cross-site scripting or XSS is a...