Instatic: Stored XSS via URL sanitization bypass (CVE-2026-103931)

Instatic version 0.0.13 and earlier are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-103931) within the isSafeUrl() function located in src/core/html-sanitize/index.ts. The sanitization logic fails to correctly filter C0 control characters (U+0000 - U+001F) when checking for malicious URL schemes such as javascript:, vbscript:, or data:. Browsers strip these leading control characters during URL parsing, allowing payloads to bypass the application's security filter and execute in the context of the admin editor's same-origin frame.

Attack Chain

1. An attacker with 'Client' role privileges (or any role capable of editing page content) crafts a malicious URL payload using leading C0 control characters (e.g., \x01javascript:alert(document.domain)).
2. The payload is submitted via a link href, image source, or custom HTML attribute field.
3. The isSafeUrl() function attempts to normalize the input but fails to remove the specific C0 control characters, incorrectly marking the payload as "safe".
4. The malicious link is stored in the site content database.
5. An administrator or owner opens the affected page within the admin editor canvas, which is an srcdoc iframe sharing the same origin as the /admin application.
6. Because the admin interface lacks a strict script-src Content Security Policy (CSP), the browser executes the javascript: payload within the admin origin upon interaction.
7. The payload executes with the privileges of the authenticated administrator, enabling session hijacking, account creation, or other malicious administrative actions.

Impact

Successful exploitation allows a low-privileged editor to escalate privileges to full administrative compromise by executing arbitrary JavaScript in the admin editor's origin. On published sites, the risk is dependent on the CSP; pages utilizing 'unsafe-inline' are vulnerable to execution of these filtered protocols.

Recommendation

1. Upgrade Instatic to a version containing the fix that properly strips the full C0 and space range from URL inputs.
2. Implement a strict script-src Content Security Policy (CSP) for the admin interface to prevent the execution of inline scripts and javascript: protocol URLs.
3. Audit existing user-contributed content for links containing non-printable or unexpected control characters.