CVE-2026-63135: Stored Cross-Site Scripting (XSS) via Referer Header in YOURLS

YOURLS (Your Own URL Shortener) incorporates an administrative and analytics dashboard that tracks and aggregates traffic patterns. The tracker extracts user-supplied metrics, specifically the HTTP Referer header, to classify referral sources for individual short URLs. This analysis takes place inside the statistics visualization pipeline.

The core flaw is classified as a Stored Cross-Site Scripting (XSS) vulnerability, mapped to CWE-79. Due to insufficient validation of string boundaries during database storage and subsequent retrieval, characters used to define boundaries in JavaScript arrays (such as single quotes, parentheses, commas, and brackets) are logged without sanitization.

When any user or administrator accesses the statistical summary page (such as http://yourls-domain/<keyword>+), the backend retrieves the log database entries. It passes the domains to an inline Google Charts script generator. The direct interpolation of unsanitized log entries inside raw JavaScript arrays results in unauthenticated client-side code execution.

The vulnerability lies in the disconnect between the input normalization routine and the visualization template rendering logic. When a client requests a shortened URL, the tracking engine reads the HTTP Referer header via the yourls_get_referrer() handler inside includes/functions.php.

Input is passed to the sanitization function yourls_sanitize_url_safe() inside includes/functions-formatting.php. While this helper intercepts CRLF injections, control characters, and standard HTML structures, it intentionally retains single quotes (') and array brackets ([ / ]), as they are valid within typical HTTP query parameters. The application then writes the parsed referrer directly into the database log table using yourls_log_redirect().

During statistics aggregation inside yourls-infos.php, the domain is parsed via yourls_get_domain() using PHP's native parse_url() function. A crafted payload that mirrors the structure of a valid URL path will allow its malicious host string to pass through. This aggregated domain list is eventually mapped directly inside yourls_google_array_to_data_table(), which outputs raw string literals inside inline JavaScript blocks to build the visualization interface.

The vulnerable manual array compilation logic inside the analytics script generation library includes/functions-infos.php fails to escape variables before outputting them to the template script:

// Vulnerable Implementation (Pre-1.10.4)
function yourls_google_array_to_data_table($data){
    $str  = "var data = google.visualization.arrayToDataTable([\n";
    foreach( $data as $label => $values ){
        if( !is_array( $values ) ) {
            $values = array( $values );
        }
        $str .= "\t['$label',"; // <-- UNSAFE: Unescaped Label
        foreach( $values as $value ){
            if( !is_numeric( $value ) && strpos( $value, '[' ) !== 0 && strpos( $value, '{' ) !== 0 ) {
                $value = "'$value'";
            }
            $str .= "$value";
        }
        $str .= "],\n";
    }
    $str .= "]);";
    return $str;
}

The upstream patch committed in e1e93476655107e6caab34e52259eb1c91079ec7 fixes this issue by securing the rendering function and enforcing strict host validation during parsing. Inside yourls_google_array_to_data_table(), context-aware escaping is applied to both key and value outputs:

// Patched Implementation (1.10.4)
function yourls_google_array_to_data_table(array $data): string {
    $str  = "var data = google.visualization.arrayToDataTable([\n";
    foreach( $data as $label => $values ){
        if( !is_array( $values ) ) {
            $values = array( $values );
        }
        $str .= "\t['" . yourls_esc_js($label) . "',"; // <-- PATCH: Escaped Label
        foreach( $values as $value ){
            $value = yourls_esc_url( $value );
            if( !is_numeric( $value ) && !str_starts_with($value, '[') && !str_starts_with($value, '{')) {
                $value = "'" . yourls_esc_js($value) . "'"; // <-- PATCH: Escaped Value
            }
            $str .= "$value";
        }
        $str .= "],\n";
    }
    $str .= "]);";
    return $str;
}

Additionally, the domain parsing utility yourls_get_domain() has been updated to enforce regex checks on hostname characters. If an illegal character like a single quote is encountered, the domain is discarded, preventing injection into the database logs altogether.

To successfully exploit this, an unauthenticated attacker triggers a redirect request on the target YOURLS instance while supplying a crafted Referer header.

The payload URL is designed to break out of the JavaScript literal context once embedded into the chart array. An example structure is http://x',1],['marker',alert(1)],['z.tld/path. When processed by the PHP XML/URL parser, the domain parser isolates x',1],['marker',alert(1)],['z.tld as the hostname.

curl -H "Referer: http://x',1],['marker',alert(1)],['z.tld/path" http://localhost/<short-code>

Once an administrator loads the stats panel for the target short-code, the payload renders inside the client browser as:

<script type="text/javascript">
var data = google.visualization.arrayToDataTable([
    ['x',1],['marker',alert(1)],['z.tld',1]
]);
</script>

The browser reads the first element ['x', 1], skips to the newly injected element array containing ['marker', alert(1)], and executes the malicious payload inside the user's active context.

The execution of malicious JavaScript within the administrative origin of YOURLS has significant consequences. Since the dashboard offers full utility options, an attacker who hijacks an administrator session can execute background requests to manipulate existing redirection configurations.

Because the administrative panel includes AJAX actions to add, modify, or delete links, an attacker can modify redirects to point to phishing pages. In addition, an attacker can query /admin/tools.php silently in the background, extract the administrator's static API signature token, and exfiltrate it. This allows permanent, passwordless access to the YOURLS API endpoint from any location.

The CVSS v3.1 metrics define the base score as 8.2 (High). The vulnerability features low complexity, does not require administrative privileges to inject, and changes the security scope from the server context to the admin's local client domain, resulting in high integrity impacts.

Administrators must upgrade their installations to version 1.10.4 or later immediately to completely address both the storage input validation and rendering output layers.

If immediate upgrading is impossible, administrators should restrict the visibility of the statistics panel. Defining YOURLS_PRIVATE_INFOS as true in user/config.php prevents unauthenticated viewers from triggering the vulnerability, though authenticated administrators remain vulnerable.

Deploying a Web Application Firewall (WAF) rule to block incoming request headers that contain single quotes alongside array brackets can stop injection attempts before they are logged to the database.