# CVE-2026-104816: Misskey RSS widget XSS via unsafe URL scheme

Source: https://junglewise.ai/threats/cve-2026-104816-misskey-is-an-open-source-federated-social-media-platform-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104816 · Severity: info · Published 2026-10-13

Misskey is a federated social media platform that supports RSS feed widgets. The RSS widget component fails to validate URL schemes in feed links, allowing an attacker who controls a feed to inject malicious links that execute scripts when users click them in the widget. This could lead to account compromise or data theft from affected users.

Technologies: [Misskey](https://junglewise.ai/threats/technologies/misskey-misskey). Vendors: [Misskey](https://junglewise.ai/threats/vendors/misskey).

## Quick answers

**Is CVE-2026-104816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104816 being exploited in the wild.

**How severe is CVE-2026-104816?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** Misskey 12.0.0 to 2026.6.x.

**Is there a fix for CVE-2026-104816?** Yes: fixed in 2026.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104816 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-104816?** Check whether you run Misskey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.7.0

## Technical details

The RSS widget displays feed item links without validating their URL schemes, allowing javascript: or data: URIs to be injected. An attacker controlling feed content can craft links that execute scripts in the browser context when clicked. This is a stored XSS vulnerability requiring the attacker to control a feed that a user subscribes to via the RSS widget.

## Affected products

- Misskey Misskey 12.0.0 to 2026.6.x

## Timeline

- 2026-10-13: disclosed
- 2026-07-31: patched

## References

- [https://github.com/misskey-dev/misskey/commit/8dd59a8c06da49b8f302d902d73d04397ee29366](https://github.com/misskey-dev/misskey/commit/8dd59a8c06da49b8f302d902d73d04397ee29366)
- [https://github.com/misskey-dev/misskey/pull/17831](https://github.com/misskey-dev/misskey/pull/17831)

## Related threats

- [Misskey fetch-rss API missing rate limits and response size restrictions](https://junglewise.ai/threats/cve-2026-104817-misskey-is-an-open-source-federated-social-media-platform-from)
- [Misskey multipart API cleanup denial of service](https://junglewise.ai/threats/cve-2026-103937-misskey-is-an-open-source-federated-social-media-platform-from)
- [Misskey login rate limit bypass via X-Forwarded-For spoofing](https://junglewise.ai/threats/cve-2025-66482-misskey-login-rate-limit-bypass-via-x-forwarded-for-spoofing)
- [Misskey.js export data contains private post data](https://junglewise.ai/threats/cve-2025-66402-misskey-js-export-data-contains-private-post-data)