GHSA-3V85-FQVH-7RXF: Stored Cross-Site Scripting in Ech0 RSS Feed Generation

Vulnerability ID: GHSA-3V85-FQVH-7RXF

CVSS Score: 5.3

Published: 2026-05-07

A stored Cross-Site Scripting (XSS) vulnerability exists in the Ech0 project's RSS feed generation component. The application fails to properly escape user-supplied tags and Markdown content before reflecting them in the /rss endpoint, allowing arbitrary JavaScript execution in vulnerable RSS readers.

TL;DR

Ech0 renders unescaped user input into its public RSS feed, permitting stored XSS attacks when users read the feed.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-79

Attack Vector : Network

CVSS Score : 5.3

Impact : Stored Cross-Site Scripting

Exploit Status : Proof-of-Concept

Authentication Required : Yes (to post/tag)

Affected Systems

Ech0 Syndication Endpoint (/rss)

Ech0 : All versions prior to fix commit fd320fe3 (Fixed in: fd320fe3e9021c8d8d284fb274775c018690520e )

Code Analysis

Commit: fd320fe

Fix: Implement HTML escaping…