{"action":"Upgrade yourls/yourls to 1.10.4 or later.","affected":[{"fixed":"1.10.4","introduced":"1.5.1"}],"component":"yourls/yourls","cve_ids":["CVE-2026-63135"],"ecosystem":"Packagist","epss":0.00425,"exploited":false,"fixed_versions":["1.10.4"],"ghsa_id":"GHSA-5h77-88j3-r659","id":"tcs_01M5KEW360ZBBAP82B4V0QYTGJ","modified_at":"2026-08-21T21:10:59.760525Z","published_at":"2026-08-21T20:57:23Z","references":["https://osv.dev/vulnerability/GHSA-5h77-88j3-r659","https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659","https://github.com/YOURLS/YOURLS/pull/4107","https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7","https://github.com/YOURLS/YOURLS","https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-5h77-88j3-r659","url":"https://osv.dev/vulnerability/GHSA-5h77-88j3-r659"}],"summary":"YOURLS has stored XSS in referrer statistics chart via crafted Referer header"}