CyberRota Analysis
AI-GeneratedDashy versions prior to 4.3.7 are vulnerable due to improper handling of URL query parameters, allowing crafted links to execute JavaScript within the Dashy environment. This can lead to unauthorized access to same-origin browser data and manipulation of the Dashy DOM by an attacker. Organizations using Dashy for personal dashboards should prioritize upgrading to version 4.3.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.