The vulnerability allows a malicious feed provider to supply a link with an unsafe URL scheme that triggers the execution of arbitrary JavaScript in the context of a user’s browser when the link is clicked within a Misskey RSS widget. This defect is an XSS flaw (CWE‑79) and can be exploited to steal session cookies, perform phishing, or otherwise compromise the user’s account. The impact is that any user viewing the compromised RSS feed and clicking the forged link can have client‑side code executed with the privileges of that user.

Misskey open‑source social media platform, versions 12.0.0 through 2026.7.0 inclusive. The issue is fixed in release 2026.7.0; earlier releases remain vulnerable.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is inferred to require user interaction: an attacker must control a feed that a user subscribes to and embed an unsafe link. Once a user clicks the link, arbitrary code runs in their browser. Given the simplicity of the exploit and the user‑interaction component, exploitation would likely occur in environments where users rely heavily on RSS widgets or where feed sources are not tightly controlled.