CVE-2026-68583: luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-02 · updated 2026-10-23
Weakness: CWE-79

Description

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.

Affected products

openwrt luci: before 1.2.4-4 — fixed in 1.2.4-4

How to fix

Upgrade to a fixed version: openwrt luci 1.2.4-4. Check the vendor advisory for mitigations.

References

https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h
https://www.vulncheck.com/advisories/luci-app-adblock-fast-before-4-stored-xss-via-file-url-name
https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h

Get alerted when CVE-2026-68583 or the next vulnerability affects your stack