CVE-2026-63135

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

• CWE-79

• https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7
• https://github.com/YOURLS/YOURLS/pull/4107
• https://github.com/YOURLS/YOURLS/releases/tag/1.10.4
• https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659
• https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659

Published

Aug 21, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6312Insufficient policy enforcement in Passwords in Google Chrom…3.1
• CVE-2026-63123Tina is a headless content management system. Prior to 2.5.2…6.5
• CVE-2026-63125Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-6313Insufficient policy enforcement in CORS in Google Chrome pri…3.1
• CVE-2026-63133Malcolm is a network traffic analysis tool suite. Prior to v…6.5
• CVE-2026-63134Malcolm is a network traffic analysis tool suite. Prior to v…5.4
• CVE-2026-63136Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-63137Incorrect Authorization (CWE-863) in Kibana can lead to priv…8.3
• CVE-2026-63138Improper Neutralization of Special Elements in Data Query Lo…6.5
• CVE-2026-63139Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-6314Out of bounds write in GPU in Google Chrome prior to 147.0.7…8.3
• CVE-2026-63140Reachable Assertion (CWE-617) in Elasticsearch can lead to d…6.5