CVE-2026-45368— Kirby 跨站脚本漏洞

Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers that produce `<a href="…">` output from editor-supplied field values: the (`link: …)` KirbyTag, the `link`: parameter of the `(image: …)` KirbyTag when it does not resolve to a known file or `self`, the `link` field of the built-in image block, and the HTML importer for the `blocks` field (which accepted the same malicious input as the image block `link` field). While simple `avascript:` URLs were already deactivated by treating them as a relative path and prepending a single slash to the URL, the use of URLs of the format `javascript://x%0A…` bypasses this protection. The `vbscript:`, `data:`, `livescript:`, `mocha:` and `jar:` schemes are affected by the same underlying gap. This issue has been fixed in versions 4.9.1 and 5.4.1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Kirby 跨站脚本漏洞

Kirby Kirby是Kirby个人开发者的一款服务器与网络设备产品。 Kirby 4.9.1之前版本和5.0.0版本至5.4.1之前版本存在跨站脚本漏洞，该漏洞源于KirbyTags和image blocks组件的URL方法未过滤恶意URL值，可能导致脚本执行。以下版本受到影响：4.9.1之前版本和5.0.0版本至5.4.1之前版本。

N/A

N/A