Vulnerability · Published Sep 5, 2021 · Assigned by snyk
CVE-2021-23439Cross-site Scripting (XSS)
Medium 4.2
In plain English
A medium-severity security flaw in file-upload-with-preview. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.9%top 40.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | file-upload-with-preview | 4.2.0 | GHSA-97pv-4338-r5vp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | file-upload-with-preview | unspecified – before 4.2.0 |
References
- https://snyk.io/vuln/SNYK-JS-FILEUPLOADWITHPREVIEW-1579492 x_refsource_MISC
- https://github.com/johndatserakis/file-upload-with-preview/blob/develop/src/file-upload-with-preview.js%23L168 x_refsource_MISC
- https://github.com/johndatserakis/file-upload-with-preview/pull/40/files?file-filters%5B%5D=.js&hide-deleted-files=true%23diff-fe47b243de17419c0daa22cd785cd754baed60cf3679d3da1d6fe006f9f4a7f0R174 x_refsource_MISC