MEDIUM 4.8 NVD
CVE-2026-79663
Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML esc
Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.
References
- https://github.com/lin-snow/Ech0/security/advisories/GHSA-3v85-fqvh-7rxf
- https://www.vulncheck.com/advisories/ech0-before-stored-xss-via-rss-feed-tag-names
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-08-25 via NVD.
vulnfeed aggregates 12116 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.