CVE-2026-55592

LOW 3.9

Dashy: XSS in workspace url parameter

CVSS Score

3.9

EPSS Score

0.3%

EPSS Percentile

17th

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.

CWE	CWE-79
Vendor	lissy93
Product	dashy
Published	Jul 7, 2026
Last Updated	Jul 8, 2026

Stay Ahead of the Next One

Get instant alerts for lissy93 dashy

Be the first to know when new low vulnerabilities affecting lissy93 dashy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

lissy93 / dashy

< 4.3.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc github.com: https://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b github.com: https://github.com/lissy93/dashy/releases/tag/4.3.7