# CVE-2026-68583: OpenWrt LuCI AdBlock Fast stored XSS in blocklist name

Source: https://junglewise.ai/threats/cve-2026-68583-openwrt-luci-adblock-fast-stored-xss-in-blocklist-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-68583 · Severity: medium · CVSS 5.4 · Published 2026-08-02

LuCI AdBlock Fast is a network ad-blocking management tool for OpenWrt routers. A lower-privileged configuration user can inject malicious HTML code into a blocklist name field, which then executes in an administrator's browser when they view the AdBlock Fast status page, potentially allowing the attacker to perform administrative actions or steal session data.

Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-68583 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68583 being exploited in the wild.

**How severe is CVE-2026-68583?** Medium severity, with a CVSS score of 5.4, published 2 August 2026.

**Which products and versions are affected?** OpenWrt LuCI AdBlock Fast before 1.2.4-4.

**Is there a fix for CVE-2026-68583?** A patch was published on 2026-07-19: Fixed in luci-app-adblock-fast 1.2.4-4; backported to openwrt-25.12, openwrt-24.10, and master branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68583 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-68583?** Check whether you run OpenWrt LuCI AdBlock Fast at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the luci-app-adblock-fast component (CWE-79). The root cause is improper HTML escaping of untrusted configuration values (the blocklist name field from UCI config adblock-fast.file_url.name) before they are inserted into the DOM via innerHTML. A lower-privileged LuCI/rpcd user with luci-base and luci-app-adblock-fast ACL can craft a malicious blocklist name containing JavaScript payload. When a blocklist download or parsing fails, the unescaped name is stored in error metadata. When an administrator opens the AdBlock Fast status page, the injected payload executes under the administrator's LuCI origin. The vulnerability requires network access to the router's web interface, low privileges (delegated user), and user interaction (admin must view the status page). The fix, applied in version 1.2.4-4, HTML-escapes all untrusted substitutions using LuCI's %h format specifier before interpolation into HTML strings.

## Affected products

- OpenWrt LuCI AdBlock Fast before 1.2.4-4

## Timeline

- 2026-07-19: disclosed: GitHub security advisory published
- 2026-08-02: advisory: NVD and public disclosure
- 2026-07-19: patched: Fixed in luci-app-adblock-fast 1.2.4-4; backported to openwrt-25.12, openwrt-24.10, and master branches

## References

- [https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h](https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h)
- [https://www.vulncheck.com/advisories/luci-app-adblock-fast-before-4-stored-xss-via-file-url-name](https://www.vulncheck.com/advisories/luci-app-adblock-fast-before-4-stored-xss-via-file-url-name)