A user who has the right to edit an album or photo may insert a Markdown link that points to a javascript: URI in the description. When the gallery view renders that description, the link is converted to safe HTML and displayed with v-html. Clicking the link causes the attacker’s script to run in the Lychee origin, potentially exposing session data or enabling authenticated requests on behalf of the victim. This flaw can be exploited via a stored payload that is rendered when anybody views the album or photo.

All installations of Lychee before version 7.6.0 that have config/markdown.php set to allow_unsafe_links. Only accounts with album‑edit permissions can create the vulnerable content, but any visitor—including unauthenticated users—to a public album can trigger the JavaScript execution when they click the rendered link.

The CVSS score of 5.7 indicates moderate severity. The EPSS score of <1% shows the likelihood of exploitation is very low, and the vulnerability is not listed in CISA’s KEV catalogue. Nevertheless, the exploit path requires no special access beyond album‑edit rights and can affect anyone who visits a public album, making the risk realistic for widely shared galleries. The attack is performed by clicking the link in the stored description, a very simple and typical user action.