CyberRota Analysis
AI-GeneratedThe vulnerability affects Takahe versions up to 0.11.0, allowing remote attackers to inject malicious `javascript:` links into federated post content and profile summaries. This can lead to session hijacking or impersonation of users when these links are clicked, compromising the integrity of the application. Organizations using Takahe should prioritize addressing this issue to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, enabling session hijacking or impersonation of viewers.