Server-Side Request Forgery in Naver's Lucy XSS Filter

CVE-2026-23768

What is CVE-2026-23768?

The Lucy XSS Filter, prior to commit 7c1de6d, is susceptible to an SSRF vulnerability when specific options, ObjectSecurityListener or EmbedSecurityListener, are enabled. This flaw occurs when embed or object tags are employed without a file extension in the src attribute, allowing attackers to induce the server to make HEAD requests to arbitrary URLs. This can lead to potential information exposure or further attacks on the application. Users should take precautionary measures to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References