Vulnerability · Published Aug 2, 2026 · Assigned by VulnCheck
CVE-2026-68583luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
Medium 5.4
In plain English
A medium-severity cross-site scripting in luci from openwrt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-q335-4c83-c88h) vendor-advisory
- VulnCheck Advisory: luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name third-party-advisory