CVE-2023-36459

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

• CWE-79

• http://www.openwall.com/lists/oss-security/2023/07/06/5Mailing List
• https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2Patch, Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
• https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hpThird Party Advisory
• http://www.openwall.com/lists/oss-security/2023/07/06/5Mailing List
• https://github.com/mastodon/mastodon/commit/6d8e0fae3e96f3cf4febe03fa7fcf5b95ff761b2Patch, Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v3.5.9Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.0.5Third Party Advisory
• https://github.com/mastodon/mastodon/releases/tag/v4.1.3Third Party Advisory
• https://github.com/mastodon/mastodon/security/advisories/GHSA-ccm4-vgcc-73hpThird Party Advisory

Published

Jul 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36439Microsoft Exchange Server Remote Code Execution Vulnerabilit…8
• CVE-2023-3644A vulnerability was found in SourceCodester Service Provider…9.8
• CVE-2023-3645The Contact Form Builder by Bit Form WordPress plugin before…4.8
• CVE-2023-36456authentik is an open-source Identity Provider. Prior to vers…7.3
• CVE-2023-364571Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-364581Panel is an open source Linux server operation and maintena…8.8
• CVE-2023-3646On affected platforms running Arista EOS with mirroring to m…7.5
• CVE-2023-36460Mastodon is a free, open-source social network server based …9.9
• CVE-2023-36461Mastodon is a free, open-source social network server based …7.5
• CVE-2023-36462Mastodon is a free, open-source social network server based …5.4
• CVE-2023-36463Meldekarten generator is an open source project to create a …6.1
• CVE-2023-36464pypdf is an open source, pure-python PDF library. In affecte…5.5