CVE-2025-31136: 
NixOS vulnerability analysis and mitigation

FreshRSS, a self-hosted RSS feed aggregator, was found to contain a critical vulnerability (CVE-2025-31136) prior to version 1.26.2. The vulnerability allows attackers to execute arbitrary JavaScript code on the feeds page through a combination of a cross-site scripting (XSS) issue in f.php when handling SVG favicons and the absence of proper Content Security Policy (CSP) (GitHub Advisory).

The vulnerability stems from two main issues: an XSS vulnerability in f.php when processing SVG favicons containing unsanitized <script> tags downloaded from attacker-controlled feeds, and the lack of CSP in f.php. The exploit involves embedding a malicious favicon in an iframe with the attribute sandbox="allow-scripts allow-same-origin". The vulnerability received a CVSS v3.1 score of 6.7 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L (GitHub Advisory).

The vulnerability enables attackers to gain unauthorized access to victim accounts. If the compromised account has administrative privileges, the attacker could potentially delete all users or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS (GitHub Advisory).

The vulnerability has been patched in FreshRSS version 1.26.2. The fix includes implementing proper Content Security Policy headers for favicons (GitHub Patch).