Description
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
Published: 2026-08-01
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw (CWE-79) in the resolver_url parameter of luci-app-https-dns-proxy that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes injected JavaScript in the administrator’s browser origin.

Affected Systems

The affected product is the luci-app-https-dns-proxy component of the OpenWrt luci web interface. No specific version numbers are listed; the flaw applies to any unpatched installation of luci-app-https-dns-proxy.

Risk and Exploitability

The CVSS score is 6.8, indicating a moderate severity, and the EPSS score is not available. The flaw requires authentication to inject the payload, so it is likely limited to users with administrative privileges, but once triggered it can execute arbitrary JavaScript under the administrator’s browser context, potentially compromising session integrity and confidentiality. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Generated by OpenCVE AI on August 3, 2026 at 09:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade luci-app-https-dns-proxy to the latest patched version.
  • Apply input validation or sanitization to the resolver_url parameter to prevent rendering of arbitrary HTML.
  • Restrict administrative access to the HTTPS DNS Proxy status page to trusted users and network segments.

Generated by OpenCVE AI on August 3, 2026 at 09:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 01 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Openwrt
Openwrt luci
Vendors & Products Openwrt
Openwrt luci

Sat, 01 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
Title luci-app-https-dns-proxy Stored XSS via resolver_url
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Openwrt Luci
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-03T15:38:30.174Z

Reserved: 2026-07-29T13:36:36.277Z

Link: CVE-2026-67352

cve-icon Vulnrichment

Updated: 2026-08-03T14:46:57.468Z

cve-icon NVD

Status : Received

Published: 2026-08-01T13:17:05.860

Modified: 2026-08-03T17:16:42.107

Link: CVE-2026-67352

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T09:45:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')