CVE-2026-67352 - luci-app-https-dns-proxy Stored XSS via resolver_url

Back Back to CVE browser

MEDIUM

luci-app-https-dns-proxy Stored XSS via resolver_url

Published Aug 1, 2026

6.8

MEDIUM

CVSS 4.0

EPSS 0.41%

Description

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.

Affected products

Vendor Openwrt Product Luci Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Openwrt

Luci

unaffected

Version	Status	Constraints
0	affected	<*

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51867
Advisory
https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6
vendor-advisory
https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-stored-xss-via-resolver-url
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51867		Advisory
https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6		vendor-advisory
https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-stored-xss-via-resolver-url		third-party-advisory