CVE-2026-104816 Misskey: Cross-site scripting in RSS feed item links

Misskey is an open source, federated social media platform. From 12.0.0 until 2026.7.0, the RSS components display feed item links from configured feeds without verifying their URL schemes. Missing URL scheme verification allows an attacker who controls feed content to provide an unsafe-scheme li...

CVE-2026-104816

The open source federated social media platform Misskey is vulnerable to Cross-site Scripting (XSS) in its RSS components. Specifically, versions 12.0.0 through 2026.7.0 fail to verify URL schemes for feed item links. An attacker who controls feed content can provide an unsafe-scheme link , leadi...