CVE-2021-41086

Katalog CVE

CVSS 5.4 · Medium EPSS 0,91%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada jsuites. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.

Rincian

Terbit di NVD

21 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 59,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jsuites/jsuites/commit/d47a6f4e143188dde2742f4cffd313e1068ad3b3 patch · advisory pihak ketiga
• https://github.com/jsuites/jsuites/commit/fe1d3cc5e339f2f4da8ed1f9f42271fdf9cbd8d2 patch · advisory pihak ketiga
• https://github.com/jsuites/jsuites/security/advisories/GHSA-qh7x-j4v8-qw5w advisory pihak ketiga