lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.
References
| Link | Resource |
|---|---|
| https://cve.naver.com/detail/cve-2026-23768.html | Vendor Advisory |
| https://github.com/naver/lucy-xss-filter/pull/31 | Exploit Patch |
Configurations
History
23 Jan 2026, 17:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:naver:lucy-xss-filter:*:*:*:*:*:*:*:* | |
| References | () https://cve.naver.com/detail/cve-2026-23768.html - Vendor Advisory | |
| References | () https://github.com/naver/lucy-xss-filter/pull/31 - Exploit, Patch | |
| First Time |
Naver
Naver lucy-xss-filter |
16 Jan 2026, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
16 Jan 2026, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-16 06:15
Updated : 2026-01-23 17:26
NVD link : CVE-2026-23768
Mitre link : CVE-2026-23768
CVE.ORG link : CVE-2026-23768
JSON object : View
Products Affected
naver
- lucy-xss-filter
CWE
CWE-918
Server-Side Request Forgery (SSRF)