CVE-2026-68583

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-4

Description A stored cross-site scripting issue exists in the blocklist name field, specifically involving the file url.name variable. This allows users with lower privileges to inject active HTML. The injected payload executes within the administrator's browser under the LuCI origin when the administrator accesses the AdBlock Fast status page.

Recommendations Update luci-app-adblock-fast to version 1.2.4-4 or later.