What is GHSA-9277-65xq-8gww?

GHSA-9277-65xq-8gww is a security advisory published by GitHub Security Advisories with Medium severity. Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed...

Which CVE IDs does GHSA-9277-65xq-8gww cover?

GHSA-9277-65xq-8gww covers the following CVE IDs: CVE-2026-79663. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9277-65xq-8gww?

GHSA-9277-65xq-8gww has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-9277-65xq-8gwwMediumCVSS 4.8

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed...

Vendor

GitHub Security Advisories

Published

August 25, 2026

Last Modified

August 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-79663 →

📋 Description

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.

🔗 References (4)

https://github.com/lin-snow/Ech0/security/advisories/GHSA-3v85-fqvh-7rxf
https://nvd.nist.gov/vuln/detail/CVE-2026-79663
https://www.vulncheck.com/advisories/ech0-before-stored-xss-via-rss-feed-tag-names
https://github.com/advisories/GHSA-9277-65xq-8gww