A security researcher discovered an XSS vulnerability in yarr, an open-source Go-based RSS reader. The issue stems from a flaw in the HTML sanitization logic where the `iframe` tag and `src` attribute are incorrectly included in the allowed tag/attribute allowlist, potentially enabling cross-site scripting attacks when malicious RSS feeds are rendered.
Background
yarr is a popular open-source RSS reader written in Go, commonly used in homelab environments. XSS vulnerabilities in RSS readers are particularly concerning as they can be triggered simply by subscribing to a malicious feed.
- Source
- Lobsters
- Published
- Oct 30, 2026 at 07:55 AM
- Score
- 7.0 / 10