medium4.6
CVE-2021-29438
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
Impact
### Impact The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. _Note_: Nextcloud Server employs a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities. ### Patches The vulnerability has been patched in version 3.1.2. If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag. ### Workarounds Make sure no user-supplied input flows into toasts.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @nextcloud/dialogs | < 3.1.2 | 3.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nextcloud\/Dialogs Project | Nextcloud\/Dialogs | before 3.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nextcloud/nextcloud-dialogs/security/advisories/GHSA-g3fq-3v3g-mh32
- https://www.npmjs.com/package/%40nextcloud/dialogs
- https://github.com/advisories/GHSA-g3fq-3v3g-mh32
- https://www.npmjs.com/package/@nextcloud/dialogs
- https://nvd.nist.gov/vuln/detail/CVE-2021-29438