CVE-2026-23769 - lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files

Back Back to CVE browser

MEDIUM

lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files

Published Jan 16, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.22%

Description

lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://cve.naver.com/detail/cve-2026-23769.html
vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2945
Advisory
https://github.com/naver/lucy-xss-filter/pull/32
mitigationPatch

Link	Providers	Tags
https://cve.naver.com/detail/cve-2026-23769.html		vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2945		Advisory
https://github.com/naver/lucy-xss-filter/pull/32		mitigationPatch

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner naver

Published Jan 16, 2026

Updated Jan 16, 2026

Reserved Jan 16, 2026

Link CVE-2026-23769

CISA Vulnrichment

Updated Jan 16, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-23769

Red Hat

No data

ENISA EUVD

Assigner naver

Published Jan 16, 2026

Updated Jan 16, 2026

Link EUVD-2026-2945

GitHub

No data