Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55592— Dashy: XSS in workspace url parameter

Quick assessment

Affected
lissy93 dashy
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

lissy93 dashy是lissy93个人开发者开源的一个可以部署在自己服务器上的个人导航/监控面板。 lissy93 dashy 4.3.7之前版本存在跨站脚本漏洞，该漏洞源于workspace视图信任url查询参数并直接分配给iframe源，缺少方案验证，可能导致已登录用户打开特制工作区链接时，JavaScript在Dashy源上运行并读取同源浏览器数据、与Dashy DOM交互以及代表受害者发送请求。

CVSS 3.9 · Low EPSS 0.28% · P19

Public Exploits 1

Nuclei · 1 CVE-2026-55592.yaml [template]

Affected Version Matrix 1

VendorProduct Version RangeStatus
lissy93 dashy < 4.3.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55592

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dashy: XSS in workspace url parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
lissy93 dashy 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
lissy93 dashy是lissy93个人开发者开源的一个可以部署在自己服务器上的个人导航/监控面板。 lissy93 dashy 4.3.7之前版本存在跨站脚本漏洞，该漏洞源于workspace视图信任url查询参数并直接分配给iframe源，缺少方案验证，可能导致已登录用户打开特制工作区链接时，JavaScript在Dashy源上运行并读取同源浏览器数据、与Dashy DOM交互以及代表受害者发送请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
lissy93 dashy < 4.3.7 -

II. Public POCs for CVE-2026-55592

# POC Description Source Link Shenlong Link
1 Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the context of the Dashy origin. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-55592.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55592

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55592 (1)

Vendor Advisories for CVE-2026-55592 (1)

Vendor Pages for CVE-2026-55592 (1)

IV. Related Vulnerabilities

Same product: dashy
Same vendor: lissy93
Same weakness: CWE-79

V. Comments for CVE-2026-55592

No comments yet

Leave a comment