CVE-2026-42455 LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin)
Attackers can execute arbitrary JavaScript in authenticated sessions by uploading unsanitized HTML archives, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42455?
CVE-2026-42455 is a high-severity cross-site scripting vulnerability in linkwarden, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload endpoint (POST /api/v1/archives/[linkId]?format=4) accepts HTML files (text/html) without sanitizing JavaScript content. When the archive is later accessed via GET /api/v1/archives/[linkId]?format=4, the HTML is served with Content-Type: text/html from the Linkwarden origin, without any Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of the authenticated Linkwarden sessio. At time of publication, there are no publicly available patches.
Weakness: CWE-79
Which versions are affected by CVE-2026-42455?
How do I fix CVE-2026-42455?
No fix has been published for CVE-2026-42455 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-42455 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42455 exists.
Sources
Also known as GHSA-fjvg-mch3-j3vg.