https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:34:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275188 EUVD-2026-275188 https://cve.radiocsirt.org/vuln/euvd-2026-275188 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30913 <p>Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.</p> <p>Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30913 https://cve.radiocsirt.org/vuln/ghsa-3c4m-j3g4-hh25 <p><strong>Affected:</strong> Packagist: flarum/nicknames</p> <p>## Summary</p> <p>When the `flarum/nicknames` extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.</p> <p>## Affected package</p> <p>- **`flarum/nicknames`** — permissive display name driver that allows special characters; affected since initial release on the `1.x` branch</p> <p>Any third-party display name driver that permits special characters would be equally affected.</p> <p>## Variants</p> <p>1. **Domain autolink** — a nickname such as `nasty.com` is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird). 2. **Markdown link syntax** — a nickname such as `[CLICK](https://evil.com)` is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird).</p> <p>## Steps to reproduce</p> <p>**Variant 1 (autolink — affects all email clients)** 1. Enable `flarum/nicknames`, set nickname to `nasty.com` 2. Trigger a notification email to another user (e.g. follow them, mention them) 3. The nickname appears as a clickable link in the received email</p> <p>**Variant 2 (markdown — affects markdown-rendering email clients)** 1. Enable `flarum/nicknames`, set nickname to `[CLICK](https://evil.com)` 2. Trigger a notification email to another user 3. In a markdown-rendering email client (e.g. Apple Mail),…</p> <p><strong>Affected:</strong> Packagist: flarum/nicknames</p> <p>## Summary</p> <p>When the `flarum/nicknames` extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.</p> <p>## Affected package</p> <p>- **`flarum/nicknames`** — permissive display name driver that allows special characters; affected since initial release on the `1.x` branch</p> <p>Any third-party display name driver that permits special characters would be equally affected.</p> <p>## Variants</p> <p>1. **Domain autolink** — a nickname such as `nasty.com` is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird). 2. **Markdown link syntax** — a nickname such as `[CLICK](https://evil.com)` is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird).</p> <p>## Steps to reproduce</p> <p>**Variant 1 (autolink — affects all email clients)** 1. Enable `flarum/nicknames`, set nickname to `nasty.com` 2. Trigger a notification email to another user (e.g. follow them, mention them) 3. The nickname appears as a clickable link in the received email</p> <p>**Variant 2 (markdown — affects markdown-rendering email clients)** 1. Enable `flarum/nicknames`, set nickname to `[CLICK](https://evil.com)` 2. Trigger a notification email to another user 3. In a markdown-rendering email client (e.g. Apple Mail),…</p> https://cve.radiocsirt.org/vuln/ghsa-3c4m-j3g4-hh25