Medium severity4.8NVD Advisory· Published Aug 25, 2026

CVE-2026-79663

Description

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lin Snow/Ech0llm-fuzzy
Range: <4.7.3

Patches

Vulnerability mechanics

References

github.com/lin-snow/Ech0/security/advisories/GHSA-3v85-fqvh-7rxfnvd
www.vulncheck.com/advisories/ech0-before-stored-xss-via-rss-feed-tag-namesnvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000