Description

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-21T21:17:01.493Z",
  "pubdate": "2026-08-21T21:17:01.493Z",
  "executiveSummary": "An unauthenticated stored Cross-Site Scripting (XSS) vulnerability exists in YOURLS from version 1.5.1 until 1.10.4. The vulnerability arises from improper handling and sanitization of the HTTP Referer header, which is logged during redirection and subsequently rendered in inline JavaScript within administrative or public statistics pages via yourls-infos.php. An unauthenticated attacker can exploit this flaw by sending crafted HTTP requests with malicious payloads in the Referer header to poison the statistics of an existing short URL. When an administrator or a statistics-page viewer accesses the affected analytics interface, the injected script executes within the context of the YOURLS origin. This compromises administrative sessions, exposes sensitive internal data including API signature tokens, and permits the execution of privileged same-origin actions.",
  "technicalDetails": "The vulnerability resides in the data pipeline responsible for capturing, processing, and rendering HTTP Referer headers within YOURLS. When a redirection occurs, the application records the HTTP Referer header utilizing yourls_get_referrer(), sanitizes it through yourls_sanitize_url_safe(), and logs the event via yourls_log_redirect(). Subsequently, the statistics aggregator collects these stored values within yourls-infos.php. The derived domain is processed through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The root cause of the vulnerability is the lack of proper JavaScript-string escaping when the chart builder dynamically concatenates domain labels directly into inline JavaScript blocks.\nTo exploit this vector, an unauthenticated attacker crafts a malicious HTTP request directed at a valid YOURLS short URL, supplying a specially engineered payload containing JavaScript execution primitives within the HTTP Referer header. Once logged and processed, the malicious payload is stored persistently in the backend database. When an administrator or a privileged user opens the corresponding statistics page (yourls-infos.php), the unescaped payload is rendered directly inside the inline JavaScript chart generation logic. Upon execution in the browser, the payload operates within the same-origin policy of the YOURLS deployment.\nThe post-exploitation impact includes the capability to interact with the DOM, extract sensitive administrator-visible data, access the API signature token, and perform privileged actions on behalf of the authenticated user. Network exposure is broad, as unauthenticated attackers can interact with the URL redirection mechanism to poison the statistics database. The vulnerability affects YOURLS versions 1.5.1 through 1.10.4 and is remediated in version 1.10.4."
}