Vulnerability · Published Jan 5, 2026 · Assigned by VulDB

CVE-2025-15454zhanglun lettura RSS ContentRender.tsx cross site scripting

Low 3.1

In plain English

A low-severity cross-site scripting in lettura from zhanglun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue.

Affected products (as reported)

Vendor	Product	Versions
zhanglun	lettura	0.1.00.1.10.1.20.1.30.1.40.1.50.1.60.1.7

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References

VDB-339487 | zhanglun lettura RSS ContentRender.tsx cross site scripting vdb-entry, technical-description
VDB-339487 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #725038 | lettura v0.1.22 XSS third-party-advisory
https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3 related
https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept exploit
https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4 patch
https://github.com/zhanglun/lettura/ product