CVE-2026-63135

Name of the Vulnerable Software and Affected Versions YOURLS versions 1.5.1 through 1.10.3

Description An unauthenticated attacker can poison the statistics of a short URL by providing a crafted HTTP Referer header. The software stores this header using yourls get referrer(), yourls sanitize url safe(), and yourls log redirect(), then processes the domain via yourls get domain(), yourls stats pie(), and yourls google array to data table(). Because the chart builder in yourls-infos.php concatenates labels into inline JavaScript without proper escaping, the crafted input allows for the execution of arbitrary JavaScript in the origin of the application. This can lead to the exposure of admin-visible data, the API signature token, and the execution of privileged same-origin actions when an administrator or a public stats-page viewer accesses the affected page.

Recommendations Update to version 1.10.4.