DuckDuckGo Program Statistics

View program

16 total issues disclosed

$0 total paid publicly

Most disclosed (4 disclosures) — None supplied

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG Browsers None supplied 6r1ff1n Critical 2026-06-11
RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers None supplied 6r1ff1n Critical 2026-06-11
XSS in Subdomain of DuckDuckGo Cross-site Scripting (XSS) - Reflected mr_r3boot Medium 2024-02-01
com.duckduckgo.mobile.android - Cache corruption Business Logic Errors webklex Medium 2021-09-26
Reflected/Stored XSS on duckduckgo.com Cross-site Scripting (XSS) - Reflected monke High 2021-04-10
DOM XSS on duckduckgo.com search Cross-site Scripting (XSS) - DOM sijisu Medium 2020-08-20
XSS on Videos IA Cross-site Scripting (XSS) - Stored capuzsec Medium 2020-07-31
DOM XSS on duckduckgo.com search Cross-site Scripting (XSS) - Reflected cujanovic Medium 2020-06-26
DOM XSS on duckduckgo.com search None supplied cujanovic High 2020-06-14
Partial bypass of #483774 with Blind XXE on https://duckduckgo.com XML External Entities (XXE) mik317 High 2019-02-25
XXE on https://duckduckgo.com XML External Entities (XXE) mik317 Critical 2019-01-31
DOM XSS on 50x.html page on proxy.duckduckgo.com Cross-site Scripting (XSS) - DOM smither High 2018-11-07
SSRF vulnerability on proxy.duckduckgo.com (access to metadata server on AWS) None supplied cujanovic Critical 2018-10-31
DOM XSS on 50x.html page Cross-site Scripting (XSS) - DOM cujanovic High 2018-10-16
SSRF on duckduckgo.com/iu/ Server-Side Request Forgery (SSRF) d0nut High 2018-09-09
SSRF in proxy.duckduckgo.com via the image_host parameter Server-Side Request Forgery (SSRF) fpatrik High 2018-08-15