CVE-2026-91146 — Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attack…
Published: 2026-09-14 · CVSS: 5.3 · CVSS 4.0
Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, enabling session hijacking or impersonation of viewers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7