CVE-2021-29271

2021-03-2718:15:13

Google

osv.dev

remark42

xss

vulnerability

comment.go

service.go

software

AI Score

Confidence

High

EPSS

0.001

Percentile

29.3%

JSON

remark42 before 1.6.1 allows XSS, as demonstrated by “Locator: Locator{URL:” followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go.

References

github.com/umputun/remark42/compare/v1.6.0...v1.6.1

vuln.ryotak.me/advisories/19