websub vulnerabilities

CVEs whose affected-version data names the websub package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-50571Medium· 5.7

4d ago

WebSub: Reflected script execution through intent-verification challenges

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by …

▾ Sunlitw3c · websubEPSS 0.23%via CVEORG