{"action":"Upgrade miniflux.app/v2 to 2.0.43 or later.","affected":[{"fixed":"2.0.43","introduced":"2.0.25"}],"component":"miniflux.app/v2","cve_ids":["CVE-2023-27592"],"ecosystem":"Go","epss":0.00586,"exploited":false,"fixed_versions":["2.0.43"],"ghsa_id":"GHSA-mqqg-xjhj-wfgw","id":"tcs_01M5KFG9BM0F0CGZ2YCX2F4WC1","modified_at":"2026-09-10T03:50:57.394078214Z","published_at":"2025-04-02T17:25:15Z","references":["https://osv.dev/vulnerability/GHSA-mqqg-xjhj-wfgw","https://github.com/miniflux/v2/security/advisories/GHSA-mqqg-xjhj-wfgw","https://nvd.nist.gov/vuln/detail/CVE-2023-27592","https://github.com/miniflux/v2/pull/1746","https://github.com/miniflux/v2","https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L76","https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L90","https://github.com/miniflux/v2/releases/tag/2.0.25","https://github.com/miniflux/v2/releases/tag/2.0.43","https://miniflux.app/docs/configuration.html#proxy-images"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-mqqg-xjhj-wfgw","url":"https://osv.dev/vulnerability/GHSA-mqqg-xjhj-wfgw"}],"summary":"Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler"}