CVE-2023-42452

    Dashboard / Vulnerabilities / CVE-2023-42452

    CVE-2023-42452

    Published: 19 Sept 2023Last Modified: 27 Aug 2026

    Summary: Mastodon vulnerable to Stored XSS through the translation feature

    Details: Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execute in the browser. The impact is limited thanks to Mastodon's strict Content Security Policy, blocking inline scripts, etc. However a CSP bypass or loophole could be exploited to execute malicious XSS. Furthermore, it requires user interaction, as this can only occur upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 contain a patch for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42452.json, https://github.com/mastodon/mastodon/security/advisories/GHSA-2693-xr3m-jhqr, https://nvd.nist.gov/vuln/detail/CVE-2023-42452, https://github.com/mastodon/mastodon/commit/ff32475f5f4a84ebf9619e7eef5bf8b4c075d0e2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fb389bd73c8a4bc2924496f6041c8eee27572d21
    Fixed -3d8ae6ab739ab1222546923c8df703260285fbc3

    Affected versions

    4.2.0-beta1
    4.2.0-beta2
    4.2.0-beta3
    4.2.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-42452 | CVE-DB