Ech0 versions prior to 1.4.8-0.20260503035519-fd320fe3e902 contain a stored cross-site scripting (XSS) vulnerability in their public RSS/Atom feed. The feed renders attacker-controlled tag names and Markdown content without proper HTML escaping, allowing injected script tags to execute in RSS readers that render HTML. This vulnerability requires admin privileges to create malicious content and affects subscribers who consume the RSS feed. A fix is available in version 1.4.8-0.20260503035519-fd320fe3e902.