Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-23768

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is en

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
naver

Description

lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NAVER lucy-xss-filter

Default version status: affected

  • 7c1de6db76749ceb7b382493da29c4348853cf6bunaffected

References