CVE-2026-63135

### Summary YOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted `Referer` header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting. This is reachable in default private installations when authenticated users view stats, and in documented configurations where `YOURLS_PRIVATE_INFOS` is set to `false` to make statistics pages public. ### Details The vulnerable source-to-sink path is: ```text HTTP Referer header -> yourls_get_referrer() -> yourls_sanitize_url_safe() -> yourls_log_redirect() -> log table referrer column -> yourls-infos.php referrer aggregation -> yourls_get_domain() -> yourls_stats_pie() -> yourls_google_array_to_data_table() -> inline JavaScript ``` Relevant code: - `includes/functions.php:240-243`: `yourls_get_referrer()` reads `$_SERVER['HTTP_REFERER']`, calls `yourls_sanitize_url_safe()`, and truncates the result to 200 bytes. - `includes/functions.php:294-307`: `yourls_redirect_shorturl()` calls `yourls_log_redirect()` before redirecting the visitor. - `includes/functions.php:516-545`: `yourls_log_redirect()` stores the sanitized referrer in the log table. - `yourls-infos.php:60-82`: the statistics page reads logged referrers and groups them by `yourls_get_domain($row->referrer)`. - `yourls-infos.php:493-498`: the statistics page passes referrer domains to `yourls_stats_pie()`. - `includes/functions-infos.php:338-355`: `yourls_google_array_to_data_table()` manually concatenates labels into JavaScript as `['$label', ...]` without escaping single quotes, backslashes, or other JavaScript string metacharacters. - `includes/functions-formatting.php:141-143` and `includes/functions-formatti