Executive brief
LuCI AdBlock Fast is a network ad-blocking management tool for OpenWrt routers. A lower-privileged configuration user can inject malicious HTML code into a blocklist name field, which then executes in an administrator's browser when they view the AdBlock Fast status page, potentially allowing the attacker to perform administrative actions or steal session data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the luci-app-adblock-fast component (CWE-79). The root cause is improper HTML escaping of untrusted configuration values (the blocklist name field from UCI config adblock-fast.file_url.name) before they are inserted into the DOM via innerHTML. A lower-privileged LuCI/rpcd user with luci-base and luci-app-adblock-fast ACL can craft a malicious blocklist name containing JavaScript payload. When a blocklist download or parsing fails, the unescaped name is stored in error metadata. When an administrator opens the AdBlock Fast status page, the injected payload executes under the administrator's LuCI origin. The vulnerability requires network access to the router's web interface, low privileges (delegated user), and user interaction (admin must view the status page). The fix, applied in version 1.2.4-4, HTML-escapes all untrusted substitutions using LuCI's %h format specifier before interpolation into HTML strings.
Affected products
- OpenWrt LuCI AdBlock Fast before 1.2.4-4
Timeline
- 2026-07-19: disclosed: GitHub security advisory published
- 2026-08-02: advisory: NVD and public disclosure
- 2026-07-19: patched: Fixed in luci-app-adblock-fast 1.2.4-4; backported to openwrt-25.12, openwrt-24.10, and master branches