jointakahe vulnerabilities

Products

• takahe 1

Latest jointakahe CVEs

Newest publication first

1. CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

   Published 2026-09-14

   Medium·CVSS 5.3 EPSS 0.34%

   Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.