CVE-2022-21241

2022-02-0810:30:35

jpcert

www.cve.org

cve-2022-21241

cross-site scripting

csv+

remote unauthenticated attacker

arbitrary script

arbitrary os command

specially crafted csv file

html tag

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

59.4%

JSON

Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag.

CNA Affected

[
  {
    "product": "CSV+",
    "vendor": "Plus one",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 0.8.1"
      }
    ]
  }
]