Is CVE-2026-79663 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79663 being exploited in the wild.

How severe is CVE-2026-79663?

Medium severity, with a CVSS score of 4.8, published 25 August 2026.

Which products and versions are affected?

github.com/lin-snow/ech0 (Go) SEMVER:introduced=0,fixed=1.4.8-0.20260503035519-fd320fe3e902; Lin-Snow Ech0 before 4.7.3.

Is there a fix for CVE-2026-79663?

Yes. github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503035519-fd320fe3e902 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79663 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79663?

Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79663: Ech0 stored cross-site scripting in RSS feed

CVE-2026-79663 · Severity: medium · CVSS 4.8 · Published 2026-08-25

Ech0 is a content sharing platform that generates RSS feeds for public consumption. Administrators can inject malicious JavaScript code through unescaped tag names and raw HTML in echo content, which executes in RSS readers that render HTML summaries. This affects all subscribers (including anonymous users) whose RSS readers support HTML rendering, potentially enabling account takeover or credential theft.

Technologies: github.com/lin-snow/ech0 (Go), Lin-Snow Ech0. Vendors: Go, Lin-Snow.

Quick answers

Is CVE-2026-79663 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79663 being exploited in the wild.
How severe is CVE-2026-79663?: Medium severity, with a CVSS score of 4.8, published 25 August 2026.
Which products and versions are affected?: github.com/lin-snow/ech0 (Go) SEMVER:introduced=0,fixed=1.4.8-0.20260503035519-fd320fe3e902; Lin-Snow Ech0 before 4.7.3.
Is there a fix for CVE-2026-79663?: Yes. github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503035519-fd320fe3e902 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79663 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79663?: Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503035519-fd320fe3e902 or later
```
go get github.com/lin-snow/ech0@v1.4.8-0.20260503035519-fd320fe3e902
```

Technical details

This is a stored cross-site scripting (XSS) vulnerability arising from two separate HTML-escaping failures in the public RSS/Atom feed generation. First, tag names are directly inserted into HTML via fmt.Appendf without escaping at internal/service/common/common.go:120, allowing a tag like "</span><script>..." to break out of its span element. Second, the Markdown renderer at internal/util/md/md.go does not set the html.SkipHTML flag, permitting raw <script> blocks in echo content to pass through unmodified into the RSS summary field. The feed declares <summary type="html">, so RSS readers decode the XML entities and execute the resulting JavaScript in the reader's origin. Attack requires admin privileges to create or edit echoes, but the XSS payload persists and affects all downstream subscribers. The vulnerability is fixed in version 4.7.3.

Affected products

lin-snow Ech0 before 4.7.3

Identifiers

CVE-2026-79663
GHSA-3v85-fqvh-7rxf
GO-2026-5100

Timeline

2026-05-03: disclosed: GitHub Security Advisory (GHSA-3v85-fqvh-7rxf) published
2026-08-25: advisory: CVE-2026-79663 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.