CVE-2026-55592

Name of the Vulnerable Software and Affected Versions Dashy versions prior to 4.3.7

Description The workspace view fails to validate the scheme of the URL query parameter before assigning it to an iframe source. This allows an attacker to execute JavaScript on the Dashy origin by tricking a logged-in user into opening a crafted workspace link containing a javascript: URL. This execution enables the attacker to read same-origin browser data, interact with the Document Object Model (DOM), and send requests on behalf of the victim.

Recommendations Update to version 4.3.7.