CVE-2026-68583

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.

Score

CVSS 3.1 5.4 Medium

Status

Deferred - disclosure@vulncheck.com

Published

2026-08-02

Last modified

2026-10-23

Weaknesses

CWE-79

Affected products

• Luci-app-adblock-fast (Mossdef)

References

• https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h
• https://www.vulncheck.com/advisories/luci-app-adblock-fast-before-4-stored-xss-via-file-url-name