jointakahe CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM jointakahe CVE published 2026-09-14

CVE-2026-91146

CVE-2026-91146 debrief: Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. This vulnerability enables attackers to deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, potentially leading to session hijacking or impersonation of vie [truncated]