Cloudanix VulnDB

GHSA-3v85-fqvh-7rxf

Medium · 4.8

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

CVSS

4.8

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

The public RSS/Atom feed at `/rss` renders two attacker-controlled surfaces without HTML escaping. Tag names flow through `fmt.Appendf(renderedContent, "<br /><span class=\"tag\">#%s</span>", tag.Name)` at `internal/service/common/common.go:120`, and the Markdown renderer at `internal/util/md/md.go` does not set the `html.SkipHTML` flag, so raw HTML blocks in echo content pass through unmodified. The resulting Atom `<summary type="html">` is valid XML but contains executable `<script>` tags after the RSS reader decodes it. RSS subscribers whose readers render HTML (including many self-hosted and desktop clients) execute attacker JavaScript in the reader's origin.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities