Lychee, an open-source photo management tool, has a CWE-79 XSS vulnerability (CVE-2026-33738) in versions before 7.5.3. The photo description field is stored without sanitization and rendered using unescaped Blade syntax ({!! $item->summary !!}) in feed templates. Because the /feed endpoint is publicly accessible without authentication, malicious scripts embedded in photo descriptions can execute in RSS readers consuming these feeds. This vulnerability is resolved in Lychee version 7.5.3.

An attacker can inject JavaScript code into the photo description field, which will be executed in the context of any RSS reader accessing the /feed endpoint. This can lead to typical XSS impacts such as session hijacking, phishing, or other malicious actions within the RSS reader environment. The vulnerability requires user interaction (viewing the feed) and has limited scope due to the feed context.

Upgrade Lychee to version 7.5.3 or later, where the vulnerability is fixed by properly sanitizing the photo description field and rendering it safely. No other mitigation is required as the fix is official and available.