Vulnerability GHSA-6mp4-q625-mxjp

Summary

The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLS_PRIVATE is set to false (public API mode), this vulnerability can be exploited by any unauthenticated attacker. In private mode, the XSS payload is still injected into the 403 response body though browser execution is blocked.

Details

Vulnerability exists in the JSONP callback handling chain:

yourls-api.php:127-128

if( isset( $_REQUEST['callback'] ) )
    $return['callback'] = $_REQUEST['callback'];
elseif ( isset( $_REQUEST['jsonp'] ) )
    $return['callback'] = $_REQUEST['jsonp'];