Security

Report a vulnerability

SECURITY.md

Reporting Security Issues

If you discover a security issue in Misskey, please report it by this form.

This will allow us to assess the risk, and make a fix available before we add a bug report to the GitHub repository.

Thanks for helping make Misskey safe for everyone.

When create a patch

If you can also create a patch to fix the vulnerability, please create a PR on the private fork.

Note

There is a GitHub bug that prevents merging if a PR not following the develop branch of upstream, so please keep follow the develop branch.

Impersonation and takeover of remote accounts with unnormalized signed activities
GHSA-2vxv-pv3m-3wvj published Jun 2, 2024 by syuilo

High
Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts
GHSA-qqrm-9grj-6v32 published Feb 17, 2024 by syuilo

High
Improper authorization when accessing with third-party application
GHSA-7pxq-6xx9-xpgm published Dec 29, 2023 by syuilo

Critical
Misskey's missing signature validation allows arbitrary users to impersonate any remote user.
GHSA-3f39-6537-3cgc published Nov 25, 2023 by syuilo

Critical
Bypass authentication of Bull dashboard
GHSA-9fj2-gjcf-cqqc published Sep 30, 2023 by syuilo

High
XSS of ActivityPub URI
GHSA-pfp5-r48x-fg25 published Feb 22, 2023 by syuilo

High
SQL injection of notes/search-by-tag
GHSA-cgwp-vmr4-wx4q published Feb 22, 2023 by syuilo

High
XSS vulnerability using url preview
GHSA-vc39-c453-67g3 published Feb 22, 2023 by syuilo

High
XSS vulnerability using authentication callback
GHSA-cc6r-chgr-8r5m published Feb 22, 2023 by syuilo

High
Server-Side Request Forgery vulnerability in download
GHSA-mqv7-gxh4-r5vf published Sep 7, 2021 by syuilo

High

Learn more about advisories related to misskey-dev/misskey in the GitHub Advisory Database