CVE-2026-23768 Details
Description
lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.
A server-side request forgery (SSRF) vulnerability has been identified in Lucy XSS Filter, prior to commit 7c1de6d. This vulnerability allows an attacker to induce HEAD requests to arbitrary URLs. The issue arises when the ObjectSecurityListener or EmbedSecurityListener options are enabled, and object or embed tags are used with a src attribute that lacks a file extension.
To address this vulnerability, it is recommended to modify the dynamic MIME type checking mechanism used by the 'checkVulnerableWithHttp' function. Instead of relying on HTTP requests to determine the MIME type, which can lead to this vulnerability, consider using a fixed value, such as 'application/octet-stream', when the MIME type cannot be reliably assessed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cve.naver.com/detail/cve-2026-23768.html | [email protected] | Vendor Advisory |
| https://github.com/naver/lucy-xss-filter/pull/31 | [email protected] | ExploitPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| naver lucy-xss-filter | < 2025-06-08 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 23, 2026 | Initial Analysis | [email protected] |
| Jan 16, 2026 | CVE Modified | CISA-ADP |
| Jan 16, 2026 | New CVE Received | [email protected] |