CVE-2021-3427

2022-08-2600:00:00

CWE-79

redhat

www.cve.org

deluge web-ui

xss

crafted torrent file

data sanitization

arbitrary code execution

0.001 Low

EPSS

Percentile

34.5%

JSON

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it’s interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user’s browser session.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Deluge-web",
    "versions": [
      {
        "version": "Not-Known",
        "status": "affected"
      }
    ]
  }
]