NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

CVE-2026-30913 — nicknames

MEDIUMFix: flarum/nicknames@4dde997

CVE-2026-30913 is a medium-severity (CVSS 4.6) Cross-site Scripting (XSS) vulnerability in flarum/nicknames. A fix is available for flarum/nicknames — see the affected versions and patch details below.

flarum/nickname: Display name injection in notification emails (autolink & markdown)

Also known asGHSA-3c4m-j3g4-hh25
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-30913.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk+0.02%
Lower risk than most CVEs10th percentile — riskier than 10% of all scored CVEsHighest risk
0.00%0.26%0.53%0.79%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘flarum/nicknames

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

Affected package

  • flarum/nicknames — permissive display name driver that allows special characters; affected since initial release on the 1.x branch

Any third-party display name driver that permits special characters would be equally affected.

Variants

  1. Domain autolink — a nickname such as nasty.com is automatically converted to a clickable hyperlink by virtually all email clients (Gmail, Outlook, Apple Mail, Thunderbird).
  2. Markdown link syntax — a nickname such as [CLICK](https://evil.com) is rendered as a clickable hyperlink by email clients that auto-render markdown in plain-text emails (e.g. Apple Mail, Thunderbird).

Steps to reproduce

Variant 1 (autolink — affects all email clients)

  1. Enable flarum/nicknames, set nickname to nasty.com
  2. Trigger a notification email to another user (e.g. follow them, mention them)
  3. The nickname appears as a clickable link in the received email

Variant 2 (markdown — affects markdown-rendering email clients)

  1. Enable flarum/nicknames, set nickname to [CLICK](https://evil.com)
  2. Trigger a notification email to another user
  3. In a markdown-rendering email client (e.g. Apple Mail), the nickname appears as a clickable link

Impact

Phishing / social engineering: victims may be misled into visiting attacker-controlled URLs via links appearing to originate from a trusted platform notification email. Variant 1 is exploitable against virtually all email clients without any special conditions.

  • CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N — 4.6 Medium

Root cause

The default username-based display name driver constrains values to [a-zA-Z0-9_-]+, making it immune. flarum/nicknames introduced permissive validation (min/max length and an optional admin-configured regex) that allows arbitrary characters including those meaningful in URL and markdown contexts. This has been the case since the first commit of the extension.

Proposed fix

  • Add validation in flarum/nicknames to reject or sanitize nicknames containing characters that email clients may interpret as URLs or markdown links
  • Alternatively, sanitize the display name before insertion into notification email bodies so that legitimate nicknames like Jane.Smith are preserved but rendered safely

References

  • Bug bounty submission: SBB-L4ZVAFH8 (Intigriti)

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistflarum/nicknamesall versions1.8.3composer require flarum/nicknames:^1.8.3

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for flarum/nicknames, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update flarum/nicknames to 1.8.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-30913 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

## Summary When the `flarum/nicknames` extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains. ## Affected package - **`flarum/nicknames`** — permissive display name driver that allows special characters; affected since initial release on the `1.x` branch Any third-party display name driver that permits special characters would be equally affected. ## Variants 1. **Domain autolink** —
O3 Security · Impact-Aware SCA

Is CVE-2026-30913 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-30913: nicknames — Fixed in 1.8.3