Vulnerability Details CVE-2021-29438
The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 44.7%
CVSS Severity
CVSS v3 Score 4.6
CVSS v2 Score 4.3
References
Products affected by CVE-2021-29438
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:0.0.1
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:0.0.2
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:0.0.3
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:0.1.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:0.1.1
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.0.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.1.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.2.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.2.1
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.2.2
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.3.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.3.1
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:1.4.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:2.0.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:2.0.1
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:3.0.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:3.0.1
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:3.1.0
-
cpe:2.3:a:nextcloud/dialogs_project:nextcloud/dialogs:3.1.1