CVE-2026-25154: 
NixOS vulnerability analysis and mitigation

CVE-2026-25154 is a stored Cross-Site Scripting (XSS) vulnerability in LocalSend, a free open-source local file-sharing application, affecting all versions up to and including 1.17.0. When a user initiates a "Share via Link" session, the application's web interface fails to sanitize filenames before rendering them as HTML, allowing script injection via maliciously named files. The vulnerability was published on January 30, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the handleFilesDisplay function within app/assets/web/main.js. This function iterates over files returned by the server's prepare-download API endpoint and concatenates file.fileName directly into an HTML string, which is then assigned to document.getElementById('file-list').innerHTML without any escaping or encoding (GitHub Advisory). The filename originates from app/lib/provider/network/server/controller/send_controller.dart, where WebSendFile objects are populated using raw filesystem filenames with no sanitization. An attacker can exploit this by renaming a file to contain a malicious HTML/JavaScript payload (e.g., <script>alert(1)</script>) and sharing it via the "Share via Link" feature, or by persuading a victim to share such a file themselves (GitHub Patch).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who views the shared file list, resulting in low confidentiality and integrity impact with no availability impact. This can lead to theft of sensitive information accessible within the browser context, unauthorized actions performed on behalf of the victim, or manipulation of the shared file interface. The scope is changed, meaning the impact extends beyond the LocalSend application itself to the victim's browser environment (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating the attack via a file named with an embedded <script>alert(1)</script> payload. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.029% (0.000290), indicating low probability of near-term exploitation (GitHub Advisory). No threat actor attribution has been reported.

1. Prepare malicious file: On the attacker's system, create a file with a name containing an XSS payload, e.g., touch "<script>alert('XSS')</script>.txt".
2. Initiate sharing: Open LocalSend (version ≤ 1.17.0), navigate to the "Send" tab, select the maliciously named file, and choose "Share via Link" mode. The application starts a local HTTP server (default port 53317).
3. Deliver the link: Send the generated share link (e.g., http://<host-ip>:53317) to a victim on the same or reachable network, or persuade a victim to share a file they previously received with the malicious filename.
4. Trigger XSS: When the victim opens the share link in their browser, the handleFilesDisplay function in main.js renders the unsanitized filename directly into innerHTML, causing the embedded script to execute in the victim's browser context.
5. Achieve objective: The executed script can steal cookies, perform actions on behalf of the victim, or exfiltrate data accessible within the browser session (GitHub Advisory).

• Network: HTTP requests to the LocalSend web share server (default port 53317) from unexpected or external hosts; unusual outbound connections from the victim's browser following access to a share link.
• File System: Files present on the system with names containing HTML/JavaScript special characters or tags (e.g., <script>, <img onerror=, javascript:) in the filename.
• Logs: LocalSend server access logs showing requests to the share endpoint from multiple or unexpected IP addresses; browser developer console errors or unexpected script execution events when accessing a LocalSend share URL.

Upgrade LocalSend to any version beyond 1.17.0 that includes the patch from commit 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c, which introduces an escapeHtml() function that properly encodes &, <, >, ", and ' characters before inserting filenames into the DOM (GitHub Patch). As a temporary workaround, restrict use of the "Share via Link" feature to trusted network environments only and avoid sharing files received from untrusted sources. Users should also avoid opening share links from unknown or untrusted LocalSend hosts (GitHub Advisory).

The vulnerability was reported by security researcher "veygax" and published by the LocalSend maintainer (Tienisto) via GitHub Security Advisories on January 30, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).