CVE-2026-55592 Details
Description
Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy origin and can read same-origin browser data, interact with the Dashy DOM, and send requests as the victim. This issue is fixed in version 4.3.7.
A cross-site scripting (XSS) vulnerability has been identified in Dashy, a self-hostable personal dashboard, in versions prior to 4.3.7. The issue arises because the workspace view improperly trusts the 'url' query parameter, directly assigning it to an iframe source without validating the scheme. This flaw allows a logged-in user to execute JavaScript on the Dashy origin by opening a manipulated workspace link that includes a 'javascript:' URL. The injected script could access same-origin browser data, interact with the Dashy DOM, and send requests as the victim.
Users can upgrade to Dashy version 4.3.7 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/lissy93/dashy/commit/4bc620e21cc8e3466f32b8bc40614b0d0eb5648b | [email protected] | Source CodeVendor |
| https://github.com/lissy93/dashy/releases/tag/4.3.7 | [email protected] | Release NotesVendor |
| https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dashy | <= 1.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |