Log in Start free

Vulnerability · Published Sep 27, 2021 · Assigned by snyk

CVE-2021-23445Cross-site Scripting (XSS)

Low 3.1

In plain English

A low-severity security flaw in datatables.net. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)2.0%top 19.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12datatables.js1.10.21+dfsg-3DEBIAN-CVE-2021-23445
Debian:13datatables.js1.10.21+dfsg-3DEBIAN-CVE-2021-23445
Debian:14datatables.js1.10.21+dfsg-3DEBIAN-CVE-2021-23445
Ubuntu:22.04:LTSdatatables.jsno fix listedUBUNTU-CVE-2021-23445
Ubuntu:24.04:LTSdatatables.jsno fix listedUBUNTU-CVE-2021-23445
Ubuntu:25.10datatables.jsno fix listedUBUNTU-CVE-2021-23445
Ubuntu:26.04:LTSdatatables.jsno fix listedUBUNTU-CVE-2021-23445
Ubuntu:26.10datatables.jsno fix listedUBUNTU-CVE-2021-23445
npmdatatables.net1.11.3GHSA-h73q-5wmj-q8pj

Affected products (as reported)

VendorProductVersions
n/a datatables.net unspecified – before 1.11.3

References