Is CVE-2026-54443 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54443 being exploited in the wild.

How severe is CVE-2026-54443?

Informational severity, with a CVSS score of 5.9, published 15 July 2026.

Which products and versions are affected?

Lissy93 Dashy >= 1.9.4, < 3.2.0.

Is there a fix for CVE-2026-54443?

A patch was published on 2026-03-30: Version 3.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54443 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54443?

Check whether you run Lissy93 Dashy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54443: Lissy93 Dashy XSS in RSS Widget

Q: Is there a fix for CVE-2026-54443?

A patch was published on 2026-03-30: Version 3.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54443 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54443?

Check whether you run Lissy93 Dashy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54443 · Severity: info · CVSS 5.9 · Published 2026-07-15

Dashy is a self-hostable dashboard used to organize and access personal web services. A security flaw in its RSS feed widget allows a malicious or compromised news feed to execute unauthorized code in a user's browser when they click on a feed item. This could lead to the theft of login sessions or sensitive information from the dashboard.

Technologies: Lissy93 Dashy. Vendors: Lissy93.

Quick answers

Is CVE-2026-54443 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54443 being exploited in the wild.
How severe is CVE-2026-54443?: Informational severity, with a CVSS score of 5.9, published 15 July 2026.
Which products and versions are affected?: Lissy93 Dashy >= 1.9.4, < 3.2.0.
Is there a fix for CVE-2026-54443?: A patch was published on 2026-03-30: Version 3.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54443 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54443?: Check whether you run Lissy93 Dashy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Dashy RSS Widget due to improper neutralization of URI schemes. The component `src/components/Widgets/RssFeed.vue` fails to sanitize the `link` field of RSS items when using the default `rss2json` fetch mode. An attacker who controls a subscribed RSS feed can inject a `javascript:` URI into the feed's link attribute. When a user clicks the rendered title or 'Read More' link, the malicious script executes within the context of the Dashy origin. This can be used to exfiltrate session tokens or perform actions on behalf of the user. The issue is resolved in version 3.2.0.

Affected products

lissy93 Dashy >= 1.9.4, < 3.2.0

Timeline

2026-03-30: patched: Version 3.2.0 released
2026-06-04: advisory: GitHub Security Advisory published
2026-07-15: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.