PT-2026-3221 · Unknown · Lucy-Xss-Filter

Younghun Ko · Published 2026-01-16 · Updated 2026-01-23 · CVE-2026-23769

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions lucy-xss-filter versions prior to commit e5826c0

Description The software contains a flaw where an attacker can execute malicious JavaScript. This is due to improper sanitization resulting from misconfigured default superset rule files.

Recommendations Update to version e5826c0 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23769

Affected Products

Lucy-Xss-Filter

References · 6

• https://github.com/naver/lucy-xss-filter/pull/32 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23769 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23769 · Vendor Advisory
• https://cve.naver.com/detail/cve-2026-23769.html · Vendor Advisory
• https://t.me/cveNotify/149728 · Telegram Post
• https://twitter.com/CVEnew/status/2012126444999066012 · Twitter Post