CVE-2026-46714

This vulnerability exposes a fundamental trust boundary failure in federated software: Misskey developers treated theme objects as user preferences rather than external input, collapsing the distinction between 'my users customizing their own experience' and 'arbitrary actors on remote instances sending me crafted data.' In a single-instance deployment, a malformed theme is just an annoying self-inflicted crash. Across federation, a malicious actor can potentially deliver crafted themes through your timeline, and your client will parse them without validation. The affected versions span 8.63.0 through 2026.5.4 across the 2025.x branch — a months-long exposure window that suggests the theme parser was never subjected to adversarial testing. The parser was written against the happy path: cooperative input from users who want their colors and fonts rendered. That assumption is exactly what federation breaks. When your client receives a theme object from a federated note, it's processing untrusted input through code that assumed trusted input. What you should check: First, verify whether your instance's ActivityPub implementation propagates theme objects or theme references in federated note payloads. If themes can traverse federation boundaries passively — through timeline delivery rather than manual application — this transitions from a DoS vector requiring user interaction to one that triggers on passive timeline scrolling. Second, examine what the 2026.5.4 patch actually changed. If the fix was a surgical guard (a depth limit, timeout, or recursion check), treat it as diagnostic evidence that other client-side rendering paths in Misskey — the MFM parser, emoji renderer, note card builder — likely have the same gap. Parsers written without adversarial testing tend to share that architectural flaw across a codebase. If the fix was architectural (restructured validation before rendering), that's a more robust pattern but less informative about other paths. The vulnerability is a client-side DoS via resource exhaustion — likely memory allocation rather than immediate crash, which is more dangerous because a slowed client can persist across sessions and evade threshold-based alerting. The CVSS 5.1 rating reflects the technical severity of individual client impact, but the systemic risk in a federated context can be substantially higher: one malicious actor can potentially degrade user experience across dozens of instances simultaneously through crafted theme objects in federated timelines.

Reviewed through automated stages and approved by a human before publication.