What is CVE-2026-79663?

CVE-2026-79663 is a medium-severity vulnerability in Lin-Snow Ech0, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2026-08-25.

How severe is CVE-2026-79663?

Medium severity. CVSS v3 base score is 4.8 out of 10.

XSS in Lin-Snow Ech0

CVE-2026-79663

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.

Affected products

Lin-snow Ech0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-79663?: CVE-2026-79663 is a medium-severity vulnerability in Lin-Snow Ech0, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2026-08-25.
How severe is CVE-2026-79663?: Medium severity. CVSS v3 base score is 4.8 out of 10.