CVE-2026-63135

CVE-2026-63135 is a stored XSS in YOURLS versions 1.5.1 through 1.10.3 (excluding the patch release). The vulnerability lives in how referrer data flows from HTTP headers through sanitization functions and into Google Charts JavaScript on the stats page — a classic context-migration failure. The root cause: `yourls_sanitize_url_safe()` sanitizes data for URL contexts, but the referrer domain ultimately lands inside a JavaScript string literal in `yourls_google_array_to_data_table()`. These are fundamentally different escape contexts. URL-safe sanitization handles characters like `<` and `/` differently than JavaScript string escaping requires. The function name created a false sense of context-independence — "sanitized" was treated as universally safe rather than "safe for this specific output context." Attack prerequisites are narrower than the CVSS 8.2 suggests. An attacker needs no authentication — they simply send a crafted Referer header to any existing short URL. The payload persists in the referrer log and executes only when an admin visits the stats page for that URL. This creates a time-dependent trigger: the attack is persistent but asynchronous, dependent on admin behavior. The real severity driver is the API token. The stats page exposes the YOURLS API signature, which grants full URL management capabilities. Compromising this token enables the attacker to create malicious redirects, modify existing links, and pivot from the shortener to attack other sessions or infrastructure. This lateral movement potential is what justifies the high score despite the admin-interaction prerequisite. Priority actions: (1) Upgrade to 1.10.4 immediately — this is a one-click patch. (2) Audit your codebase for other data flows that sanitize at storage time and render in JavaScript contexts — this architectural pattern almost certainly exists elsewhere in YOURLS or similar PHP applications. (3) Consider rotating API tokens if your instance was running 1.5.1–1.10.3, since referrer logs with poisoned data may have accumulated during the exposure window. The fix architecture matters for future hardening. If 1.10.4 added context-aware escaping at the chart builder level only, you've patched a symptom. If it introduced output-context tracking infrastructure, you've addressed the root architectural assumption that sanitization at storage time is sufficient. Examine the patch to determine which applies — it informs how aggressively you should audit other output paths.

Reviewed through automated stages and approved by a human before publication.