ZIPLINE · CVE-2026-126947 · Other
NO FIX YET · SEE WHAT TO DO
Zipline before 4.5.0 does not validate the URL scheme when users create short links through POST /api/user/urls. An authenticated user can store javascript: or attacker-controlled destinations, so visitors of a trusted short link are sent to phishing or malware pages.
first public Mar 21, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Zipline instances before 4.5.0 where users can create short links. Exposure depends on who holds an account, since the flaw requires an authenticated user. Instances where only trusted administrators create links carry much lower risk.
Not affected if no-untrusted-users, zipline-4.5.0-or-later
Who cares self-hosted, zipline
version field in its package.json or the image tag in your deployment.4.5.0 or later, per the sources.Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.