YOURLS stores the HTTP Referer header from short URL redirects and aggregates referrer domains in the per-link statistics page. The vulnerability arises because the referrer domain is embedded directly into Google Charts JavaScript code without proper escaping, allowing crafted input to break out of the JavaScript string context and execute arbitrary code. The sanitization function removes some unsafe characters but still permits characters that enable JavaScript string breakout, such as single quotes and brackets. This stored XSS is triggered when an authenticated administrator or stats viewer opens the affected statistics page. The issue is confirmed in versions >=1.5.1 and <1.10.4.

An attacker can inject malicious JavaScript code into the referrer statistics chart by sending a specially crafted Referer header to any existing short URL. When an authenticated user views the statistics page, the malicious script executes in their browser context, potentially leading to session hijacking, credential theft, or other actions permitted by the user's privileges. The vulnerability requires user interaction (viewing the stats page) and affects confidentiality and integrity of the user's session. There is no impact on availability.

A patch is available for this vulnerability. Users should upgrade YOURLS to version 1.10.4 or later where this issue is fixed. Until patched, administrators should avoid viewing the referrer statistics page or restrict access to trusted users only. No vendor advisory states that no action is required or that the issue is already mitigated without patching.