The vulnerability CVE-2026-68583 is a stored cross-site scripting issue in OpenWrt's luci-app-adblock-fast before version 1.2.4-4. It arises from improper neutralization of input in the blocklist name field, which permits lower-privileged users to inject active HTML code. This injected code executes when an administrator accesses the AdBlock Fast status page, running in the context of the LuCI web interface. This could potentially allow an attacker to perform actions with the administrator's privileges in the browser session. No official remediation level or patch information is provided in the available data.

The vulnerability allows lower-privileged users to inject malicious HTML that executes in the administrator's browser when viewing the affected page. This can lead to unauthorized actions performed with the administrator's browser privileges within the LuCI interface. The impact is limited to the web interface context and requires the administrator to view the compromised page. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should monitor vendor communications for updates. Until a fix is available, restrict access to the AdBlock Fast status page to trusted users only and consider limiting lower-privileged user capabilities to modify blocklist names.