VYPR
← All advisories
Critical severity9.3NVD Advisory· Published Jul 6, 2023· Updated Jun 17, 2026

CVE-2023-36459

CVE-2023-36459

Description

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Mastodon/Mastodon3 versions
    cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:joinmastodon:mastodon:*:*:*:*:*:*:*:*range: >=1.3,<3.5.9
    • (no CPE)range: >=1.3, <3.5.9, <4.0.5, <4.1.3
    • (no CPE)range: >= 1.3, < 3.5.9
  • osv-coords
    pkg:bitnami/mastodon
    Range: >= 1.3.0, < 3.5.9

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.