CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.

• CWE-79

• https://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b
• https://github.com/lissy93/dashy/releases/tag/4.3.7
• https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc
• https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc

Published

Jul 7, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55578Pheditor is a single-file editor and file manager written in…8.8
• CVE-2026-55579Pheditor is a single-file editor and file manager written in…9.8
• CVE-2026-5558A flaw has been found in PHPGurukul PHPGurukul Online Shoppi…6.3
• CVE-2026-55583Twenty is an open-source CRM (customer relationship manageme…7.6
• CVE-2026-5559A vulnerability has been found in AntaresMugisho PyBlade 0.1…6.3
• CVE-2026-55590CakePHP Authentication is an authentication plugin for CakeP…6.1
• CVE-2026-55594ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-55595ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-55596Plate is a rich-text editor with AI and shadcn/ui. From 53.0…8.7
• CVE-2026-55597ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55599phpseclib is a PHP secure communications library. From 0.1.1…5.8
• CVE-2026-5560A vulnerability was found in PHPGurukul Online Shopping Port…6.3