CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.

• CWE-79

• https://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b
• https://github.com/lissy93/dashy/releases/tag/4.3.7
• https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc
• https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc

Published

Jul 7, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55585QWED is open-source AI verification infrastructure for deter…8.8
• CVE-2026-55586SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.6
• CVE-2026-55588ORAS (OCI Registry As Storage) is a CLI and library for mana…6.5
• CVE-2026-5559A vulnerability has been found in AntaresMugisho PyBlade 0.1…6.3
• CVE-2026-55590CakePHP Authentication is an authentication plugin for CakeP…6.1
• CVE-2026-55591Signal K Server is a server application that runs on a centr…5.8
• CVE-2026-55593Froxlor is open source server administration software. Prior…6.5
• CVE-2026-55594ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-55595ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-55596Plate is a rich-text editor with AI and shadcn/ui. From 53.0…8.7
• CVE-2026-55597ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55599phpseclib is a PHP secure communications library. From 0.1.1…5.8