Browse all 42 CVE security advisories affecting mastodon. AI-powered Chinese analysis, POCs, and references for each vulnerability.
Mastodon is an open-source, self-hosted microblogging platform designed to decentralize social networking through the ActivityPub protocol. Its architecture allows users to operate independent instances that interoperate within a federated network, prioritizing user control over centralized corporate data silos. Historically, security audits have identified approximately 35 Common Vulnerabilities and Exposures (CVEs) within the codebase. These flaws predominantly involve server-side request forgery, cross-site scripting, and improper access control mechanisms, often stemming from complex interactions between the Ruby on Rails backend and the PostgreSQL database. While no catastrophic data breaches have defined its history, the platform’s decentralized nature means security incidents are typically isolated to specific instances rather than affecting the entire network. Recent patches have focused on hardening authentication flows and mitigating injection vulnerabilities, reflecting the ongoing challenges of maintaining security in a distributed, community-driven software ecosystem.
This page lists every published CVE security advisory associated with mastodon. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.