CVE-2026-33738: 
NixOS vulnerability analysis and mitigation

CVE-2026-33738 is a stored Cross-Site Scripting (XSS) vulnerability in Lychee, a free open-source photo-management tool. The photo description field is stored without HTML sanitization and rendered using Blade's unescaped output syntax ({!! $item->summary !!}) in RSS, Atom, and JSON feed templates. All versions prior to 7.5.3 are affected; version 7.5.3 resolves the issue. It carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Stored XSS). The data flow begins in EditPhotoRequest.php, where DescriptionRule accepts any string up to 1,000 characters with no HTML sanitization. The value is stored as-is via PhotoController.php:154 ($photo->description = $request->description()), then passed to Actions/RSS/Generate.php:57 as 'summary' => $data->description ?? ''. The sink is the Blade template {!! $item->summary !!} in rss.blade.php, atom.blade.php, and json.blade.php, which explicitly outputs unescaped HTML — combined with CDATA wrapping, any embedded JavaScript executes in RSS readers that render HTML content. The /feed endpoint requires no authentication, so any visitor or RSS aggregator is exposed (GitHub Advisory, Fix PR).

An authenticated attacker with photo upload/edit privileges can inject malicious JavaScript into a photo description, which is then served to all unauthenticated consumers of the public /feed endpoint — including RSS readers, feed aggregators, and browsers. Successful exploitation can result in session hijacking, credential harvesting, phishing, or malware distribution targeting any user who accesses the feed. There is no availability impact, but both confidentiality and integrity are affected at low severity within the vulnerable component and potentially high severity in the subscriber's browser context (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including step-by-step reproduction instructions and a specific XSS payload (<img src=x onerror=alert(document.domain)>). The advisory was assessed with high confidence as a real, actionable exploit requiring only low privileges (authenticated user) and passive user interaction (a victim visiting the feed). The EPSS score is approximately 0.114%, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Authenticate: Log in to a Lychee instance (version ≤ 7.5.2) as any user with photo upload and edit permissions.
2. Upload a photo: Upload a photo to a public album to obtain a valid photo_id.
3. Inject XSS payload: Send a PATCH request to /api/v2/Photo with a malicious description:

{
  "photo_id": "TARGET_PHOTO_ID",
  "description": "<img src=x onerror=alert(document.domain)>",
  "title": "test",
  "tags": [],
  "license": "none",
  "upload_date": "2026-03-23",
  "taken_at": null,
  "from_id": null
}

4. Trigger execution: Direct a victim (or wait for an RSS reader) to access the public /feed endpoint — no authentication is required. The injected payload is rendered unescaped within the RSS/Atom/JSON feed output.
5. Achieve objective: The JavaScript executes in the victim's browser or RSS reader context, enabling session token theft, credential harvesting, or redirection to attacker-controlled infrastructure (GitHub Advisory).

• Network: Unusual PATCH requests to /api/v2/Photo containing HTML tags or JavaScript in the description field; unexpected or high-volume unauthenticated GET requests to the /feed endpoint from diverse IP addresses.
• Logs: Web server access logs showing requests to /feed from RSS aggregator user-agents combined with prior PATCH requests to /api/v2/Photo from the same authenticated session; application logs recording photo description updates containing <script>, onerror=, or similar HTML event handler patterns.
• File System: No direct file system artifacts expected for this XSS vector, but review stored photo descriptions in the database for HTML/JavaScript content.
• Database: Photo records in the photos table where the description column contains HTML tags, JavaScript URIs, or event handler attributes (e.g., onerror=, onload=, <script>) (GitHub Advisory).

Upgrade Lychee to version 7.5.3 or later, which resolves the issue by converting descriptions through a Markdown renderer (Markdown::convert()) before output and replacing unescaped {!! !!} Blade syntax with properly escaped alternatives (Lychee Release, Fix Commit). If immediate patching is not possible, restrict unauthenticated access to the /feed endpoint via web server configuration or firewall rules, or disable RSS/Atom feed functionality entirely. Deploying a Web Application Firewall (WAF) with XSS filtering rules on the /feed endpoint can provide additional interim protection.