Executive brief
Takahe is an ActivityPub server that federates content across social media platforms. The software fails to sanitize URL schemes in links within posts and profile summaries, allowing remote attackers to inject malicious javascript: links. When users click these links, attackers can steal session tokens or impersonate the viewer within the Takahe instance.
Technical details
Takahe fails to restrict URL schemes in href attributes within HTML content of federated posts and profile summaries. The vulnerability is in the HTML sanitization logic (core/html.py), which does not enforce a whitelist of safe schemes (http, https). Remote actors can craft federated ActivityPub content containing javascript: URIs that execute client-side when clicked. Exploitation requires user interaction (clicking the link), but the attack vector is network-accessible since malicious content can originate from any federated instance. The vulnerability enables session hijacking and account impersonation within the affected instance. Patches are available in versions after 0.11.0.
Affected products
- Takahe Takahe through 0.11.0
Timeline
- 2026-09-14: disclosed