PatchSiren cyber security CVE debrief
CVE-2026-63135 YOURLS CVE debrief
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.
- Vendor
- YOURLS
- Product
- Unknown
- CVSS
- HIGH 8.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-21
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-21
- Advisory updated
- 2026-08-21
Who should care
Administrators and users of YOURLS versions prior to 1.10.4 should be aware of this vulnerability and take immediate action to upgrade to the latest version. Additionally, users who have exposed YOURLS instances to the internet or have sensitive data stored in YOURLS should be particularly cautious.
Technical summary
The vulnerability in YOURLS versions prior to 1.10.4 allows an unauthenticated attacker to execute arbitrary JavaScript code in the context of the YOURLS origin. This is possible due to the lack of JavaScript-string escaping in the chart builder, which concatenates labels into inline JavaScript. The attacker can poison the statistics of an existing short URL with a crafted referrer, leading to potential unauthorized access to sensitive data and privileged actions.
Defensive priority
Immediate attention is required to address the high-severity vulnerability in YOURLS versions prior to 1.10.4. The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript code in the context of the YOURLS origin, potentially leading to unauthorized access to sensitive data and privileged actions.
Recommended defensive actions
- Upgrade YOURLS to version 1.10.4 or later
- Review and update YOURLS configurations to prevent unauthorized access
- Monitor YOURLS instances for suspicious activity
- Confirm whether affected YOURLS deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Evidence notes
The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and affected versions. However, the evidence is limited, and further verification is required to confirm the details of the vulnerability.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-21T21:17:01.493Z and has not been modified since then.