CVE-2026-55592: Dashy URL Scheme Validation Bypass in Workspace View

Technical summary

Dashy versions prior to 4.3.7 fail to validate URL schemes when processing the workspace query parameter. The application directly assigns user-supplied input to an iframe's src attribute without sanitization or scheme validation, enabling JavaScript protocol handlers (javascript:) to execute in the context of the Dashy origin. This allows attackers to bypass same-origin policy protections and access the DOM, session data, and perform authenticated requests as the victim user. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

The primary risk is unauthorized access to workspace data and potential manipulation of user sessions. Since the attack requires the victim to click a malicious link while logged in, the exposure is contextual rather than universal. However, if Dashy is used to manage sensitive infrastructure dashboards or contains authentication tokens, an attacker could escalate the impact by extracting credentials or performing administrative actions. The low CVSS score reflects the requirement for user interaction and local attack vector, but does not diminish the sensitivity of potential data exposure.

Affected systems

Dashy versions before 4.3.7 are vulnerable. The vulnerability specifically affects the workspace view functionality. Only logged-in users who interact with a crafted link are at risk; unauthenticated users are not impacted. Self-hosted Dashy instances are the primary targets, as the attack relies on social engineering to deliver the malicious link to existing users.

Exploitability

Exploiting this vulnerability requires user interaction—the victim must click a crafted link while authenticated to Dashy. There is no remote code execution or automatic exploitation mechanism. An attacker would need to social engineer a victim into clicking the malicious link, making this a targeted attack vector rather than a mass exploitation scenario. The local attack vector and requirement for prior login further constrains the threat landscape.

Remediation

Upgrade Dashy to version 4.3.7 or later, which implements URL scheme validation for iframe sources. Organizations running self-hosted instances should prioritize this update as part of regular maintenance cycles. If immediate patching is not possible, restrict access to Dashy instances to trusted networks or implement web application firewalls that block suspicious query parameters.

Patch guidance

Apply the patch by upgrading to Dashy 4.3.7 or newer. Consult the Dashy project release notes and official documentation for version-specific upgrade instructions, as self-hosted applications may have dependencies on the deployment environment. Verify the upgrade by confirming the running version and testing workspace functionality with benign links to ensure normal operations are restored.

Detection guidance

Monitor for suspicious workspace query parameters in access logs, particularly those containing 'javascript:' or 'data:' schemes. Review user authentication logs for access patterns that precede unexpected API calls or data exports. If Dashy logs are retained, search for iframe source assignments that bypass expected URL patterns. Consider implementing browser-based monitoring or endpoint detection to identify JavaScript execution from unexpected origins within the Dashy application context.

Why prioritize this

While the CVSS score is low, this vulnerability should not be ignored. The combination of data exposure risk, authentication requirement for exploitation, and the fact that Dashy often manages sensitive operational dashboards warrants moderate prioritization. Organizations heavily invested in Dashy deployments for infrastructure management should prioritize the patch over less critical updates, while those using Dashy for less sensitive purposes can incorporate the upgrade into standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 3.9 (LOW) reflects a local attack vector, low complexity, requirement for user interaction, and limited scope. The vulnerability requires a logged-in user to click a malicious link, which significantly reduces the probability of successful exploitation at scale. However, the impact—confidentiality and integrity violations through same-origin JavaScript execution—is non-negligible for sensitive deployments. Organizations should weigh the technical CVSS rating against their specific risk tolerance and the sensitivity of data within their Dashy instances.

Frequently asked questions