CVE-2026-23768

The lucy-xss-filter library, prior to commit 7c1de6d , is vulnerable to Server-Side Request Forgery (SSRF) . If the ObjectSecurityListener or EmbedSecurityListener options are enabled, an attacker can induce the server to make HEAD requests to arbitrary URLs. This occurs when embed or object tags...

CVE-2026-23768

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension...

PT-2026-3220

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension...