Cross-site Scripting Vulnerability in FreshRSS by FreshRSS

CVE-2025-31136

What is CVE-2025-31136?

FreshRSS, a self-hosted RSS feed aggregator, is susceptible to a serious cross-site scripting (XSS) vulnerability prior to version 1.26.2. This vulnerability enables an attacker to execute arbitrary JavaScript by exploiting an improperly sanitized feed containing malicious SVG favicons. By embedding these favicons within an iframe that allows script execution, an attacker can circumvent security measures. The exploitation requires that the attacker controls a feed the victim is subscribed to and that the victim has an account on FreshRSS. Upon triggering the payload, which can activate through user interaction or immediately after a feed addition or login, the attacker could potentially compromise the victim's account. This could lead to severe consequences, including unauthorized account access and potential server-side code execution through malicious fetch requests. FreshRSS has addressed this vulnerability in version 1.26.2, emphasizing the importance of updating to ensure protection.

References