Stored XSS in RSS/Atom Feed via Unescaped HTML/Markdown

Vulnerability Overview Title: RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers Description: Summary: The public RSS/Atom feed at exposes two surfaces controlled by attackers that are not HTML-escaped. Tag names are passed through in , and the Markdown renderer in does not have the flag set, causing raw HTML blocks in Echo content to be passed through unchanged. The resulting Atom is valid XML but contains executable tags. After the RSS reader decodes the content, RSS subscribers (including many self-hosted and desktop clients) execute attacker-controlled JavaScript within the reader context. Details: - Tag Names: Passed through without HTML escaping. Tag names originate from user-provided values and are passed after string processing. strips the character from tag names and trims whitespace, but does not affect Markdown metacharacters. This allows elements in tag names to inject executable JavaScript into the RSS summary field. - Markdown: The library passes raw HTML when is not set. produces rendered HTML as the body in ; tag markings are appended to the output, and after combining bytes at line 120, they form the RSS summary field. - RSS Readers: Declaring means content is encoded as XML according to Atom RFC 4287 §3.1.1.3. RSS readers decode XML entities and pass the decoded string to the HTML renderer. Any script tags survive this decoding round. - Echo Creation: Requires an admin role ( checks ). In a single-admin Echo instance, this constitutes a self-XSS attack. In multi-admin deployments (where non-admin admins are managed by the owner), an admin can inject XSS into the shared RSS feed, which is then consumed by other admins, registered users, and anonymous subscribers. - Precedent: Previous GHSA-69hx-63pw-8f4d (2020-04-09) accepted stored XSS via SVG file upload, sharing the same prerequisite of "admin-created content." Cross-subscriber RSS XSS falls into the same category. Impact Scope Impact: - Non-admin admins (or the owner, if the RSS push target for subscribers is not hardcoded by the owner) can inject persistent JavaScript into the public RSS feed. The RSS feed reaches: - Anonymous subscribers who follow the blog's RSS URL in their readers. - Registered non-admin users who may have subscribed to the feed. - Other administrators on the same instance. - Each subscriber's reader renders content, executing the attacker's script in the reader's context. Depending on the reader, the payload can: - Read the reader's own tokens and evict them. - Forge authenticated requests to other feeds polled by the reader (cross-domain data theft). - Plant phishing content that appears as legitimate feed entries. - This class is stored XSS with cross-user scope. The severity is comparable to GHSA-69hx-63pw-8f4d (SVG upload stored XSS, rated Medium); the scope is similar (anonymous subscribers via published feed URLs), and the admin prerequisite matches. Remediation Recommended Fixes: - Two independent fixes are required: - Tag Names: Perform HTML escaping before interpolation. - Markdown: Add to the renderer flags to strip raw HTML from Echo markdown. - Validate Tag Names: Validate tag names upon creation. The central validator in rejects tag names containing , , or before they reach the database, removing attacker payloads. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in RSS/Atom Feed via Unescaped HTML/Markdown

More from this source