Executive brief
Ech0 is a content sharing platform that generates RSS feeds for public consumption. Administrators can inject malicious JavaScript code through unescaped tag names and raw HTML in echo content, which executes in RSS readers that render HTML summaries. This affects all subscribers (including anonymous users) whose RSS readers support HTML rendering, potentially enabling account takeover or credential theft.
Technical details
This is a stored cross-site scripting (XSS) vulnerability arising from two separate HTML-escaping failures in the public RSS/Atom feed generation. First, tag names are directly inserted into HTML via fmt.Appendf without escaping at internal/service/common/common.go:120, allowing a tag like "</span><script>..." to break out of its span element. Second, the Markdown renderer at internal/util/md/md.go does not set the html.SkipHTML flag, permitting raw <script> blocks in echo content to pass through unmodified into the RSS summary field. The feed declares <summary type="html">, so RSS readers decode the XML entities and execute the resulting JavaScript in the reader's origin. Attack requires admin privileges to create or edit echoes, but the XSS payload persists and affects all downstream subscribers. The vulnerability is fixed in version 4.7.3.
Affected products
- lin-snow Ech0 before 4.7.3
Timeline
- 2026-05-03: disclosed: GitHub Security Advisory (GHSA-3v85-fqvh-7rxf) published
- 2026-08-25: advisory: CVE-2026-79663 published on NVD