High severity7.6NVD Advisory· Published Aug 1, 2026· Updated Sep 8, 2026

CVE-2026-67352

Description

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Openwrt/luci-app-https-dns-proxyllm-fuzzy
Openwrt/Lucillm-fuzzy

Patches

Vulnerability mechanics

References

github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6nvd
www.vulncheck.com/advisories/luci-app-https-dns-proxy-stored-xss-via-resolver-urlnvd

News mentions

No linked articles in our index yet.

cvss	0.494
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000