Misskey CSS Style Injection Vulnerability In `MkUrlPreview`

Description

Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in `UrlPreviewService` and `MkUrlPreview`, it is possible for an attacker to inject arbitrary CSS into the `MkUrlPreview` component. `UrlPreviewService.wrap` falls back to returning the original URL if it's using a protocol that is likely to not be understood by Misskey, IE something other than `http` or `https`. This both can de-anonymize users and_allow further attacks in the client. Additionally, `MkUrlPreview` doesn't escape CSS when applying a `background-image` property, allowing an attacker to craft a URL that applies arbitrary styles to the preview element. Theoretically, an attacker can craft a CSS injection payload to create a fake error message that can deceive the user into giving away their credentials or similar sensitive information. Version 2025.4.1 contains a patch for the issue.

Scores

EPSS (exploitation in 30 days)

0.26% · top 82% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Weakness

• CWE-20: Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs
• CWE-116: Improper Encoding or Escaping of Output (opens in a new tab)All about CWE-116 and its CVEs

Affected products

• misskey-dev · misskey

  • affected >= 12.0.0, < 2025.4.1

References (2)

• https://github.com/misskey-dev/misskey/security/advisories/GHSA-3p2w-xmv5-jm95 (opens in a new tab)x_refsource_CONFIRM
• https://github.com/misskey-dev/misskey/commit/d10fdfe9738b17a9d81037c031b40a2cc4cb8038 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-46340](https://trackcve.app/badge/CVE-2025-46340.svg)](https://trackcve.app/cve/CVE-2025-46340)

Record last updated 5 May 2025, 18:46 UTC.