What is CVE-2023-36459?

CVE-2023-36459 is a critical-severity vulnerability in Joinmastodon Mastodon, classified under Cross-site Scripting. CVSS score: 9.3/10. Published 2023-07-06.

How severe is CVE-2023-36459?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Is CVE-2023-36459 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Joinmastodon Mastodon

CVE-2023-36459

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2023-07-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.012 (68.2th percentile), scored 2026-10-20.

Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000

Affected products

Joinmastodon Mastodon
Mastodon — versions >= 1.3, < 3.5.9, >= 4.0.0, < 4.0.5, >= 4.1.0, < 4.1.3

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hp (Third Party Advisory)
github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2 (Patch, Third Party Advisory)
github.com/mastodon/mastodon/releases/tag/v3.5.9 (Third Party Advisory)
github.com/mastodon/mastodon/releases/tag/v4.0.5 (Third Party Advisory)
github.com/mastodon/mastodon/releases/tag/v4.1.3 (Third Party Advisory)
www.openwall.com/lists/oss-security/2023/07/06/5 (Mailing List)

Frequently asked questions

What is CVE-2023-36459?: CVE-2023-36459 is a critical-severity vulnerability in Joinmastodon Mastodon, classified under Cross-site Scripting. CVSS score: 9.3/10. Published 2023-07-06.
How severe is CVE-2023-36459?: Critical severity. CVSS v3 base score is 9.3 out of 10.
Is CVE-2023-36459 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.