CVE-2026-97723

Name of the Vulnerable Software and Affected Versions madpsy ka9q ubersdr versions prior to 0.1.58

Description A stored cross-site scripting (XSS) issue exists in the chat message rendering functionality. User-controlled URLs in chat messages are insufficiently neutralized before being converted into HTML links. This allows quotation characters to break out of the generated href attribute and introduce attacker-controlled HTML attributes, leading to the execution of arbitrary JavaScript in the browser of another user when the stored chat message is rendered. This execution occurs without requiring the user to click on the malicious link.

Recommendations Update to version 0.1.58 or later.