YaCy Search Server Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in YaCy Search Server within the 'source/net/yacy/http/servlets' module. The issue arises in the 'YaCyDefaultServlet.java' file, where improper input neutralization during web page generation can lead to XSS attacks. This vulnerability is caused by the use of 'URIUtil.addPaths' instead of 'URIUtil.addEncodedPaths', which may not correctly encode special characters, potentially allowing for path injection or XSS.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to the latest version of YaCy Search Server, where this vulnerability has been addressed.