Cross-Site Scripting Vulnerability in YOURLS URL Shortener
CVE-2026-63135

8.2HIGH

Key Information:

Vendor

Yourls

Status
Yourls
Vendor
CVE Published:
21 August 2026

What is CVE-2026-63135?

The YOURLS URL shortener, versions 1.5.1 to 1.10.4, is susceptible to a cross-site scripting vulnerability due to unsafe handling of the HTTP Referer header. The affected software aggregates data in a way that allows an unauthenticated attacker to inject malicious JavaScript into the statistics page. This could lead to unauthorized access to sensitive admin data and API tokens when such statistics are viewed. The vulnerability has been addressed in version 1.10.4, and users are urged to upgrade to ensure their installations are secure.

Affected Version(s)

YOURLS >= 1.5.1, < 1.10.4

References

https://github.com/YOURLS/YOURLS/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/YOURLS/YOURLS/pull/4107
x_refsource_MISC
https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6c...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.