CVE-2023-24811

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulnerability due to insufficient URL validation. Arbitrary JavaScript is executed when a malicious URL is loaded in the `View in Player` or `View in Window` preview. This has been fixed in version 13.3.2. Users are advised to upgrade. Users unable to upgrade should avoid usage of the `View in Player` or `View in Window` functions.

• CWE-79
• CWE-79

• https://github.com/misskey-dev/misskey/commit/38f9d1e76428bea47c5944c440eab25428c7d99ePatch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-vc39-c453-67g3Vendor Advisory
• https://github.com/misskey-dev/misskey/commit/38f9d1e76428bea47c5944c440eab25428c7d99ePatch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-vc39-c453-67g3Vendor Advisory

Published

Feb 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24806Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2023-24807Undici is an HTTP/1.1 client for Node.js. Prior to version 5…7.5
• CVE-2023-24808 PDFio is a C library for reading and writing PDF files. In …6.5
• CVE-2023-24809NetHack is a single player dungeon exploration game. Startin…5.5
• CVE-2023-2481 Compiler removal of buffer clearing in sli_se_opaque_im…7.5
• CVE-2023-24810Misskey is an open source, decentralized social media platfo…6.1
• CVE-2023-24812Misskey is an open source, decentralized social media platfo…9.8
• CVE-2023-24813Dompdf is an HTML to PDF converter written in php. Due to th…9.8
• CVE-2023-24814TYPO3 is a free and open source Content Management Framework…6.1
• CVE-2023-24815Vert.x-Web is a set of building blocks for building web appl…5.3
• CVE-2023-24816IPython (Interactive Python) is a command shell for interact…7
• CVE-2023-24817RIOT-OS, an operating system for Internet of Things (IoT) de…7.5