High severity · published Aug 1, 2026
CVE-2026-67352
luci-app-https-dns-proxy Stored XSS via resolver_url
7.6
CVSS
0.4%
EPSS
No
On KEV
Description
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LU
luci · openwrt
0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67352
github.com
https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6
www.vulncheck.com
https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-stored-xss-via-resolver-url
More from luci
9.9
CVE-2026-72842
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
9.9
CVE-2026-72841
luci-app-openvpn Path Traversal RCE via instance_name2
9.8
CVE-2019-12272
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command…
8.8
CVE-2026-55897
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
8.8
CVE-2026-72840
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write