CVE-2021-43635

2022-02-0418:15:07

Google

osv.dev

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.8%

JSON

A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.

CPENameOperatorVersion
codexeq1.2.2
codexeq1.3.1
codexeq1.2.2-signed
codexeq1.2.1
codexeq1.3.0

Name	Operator	Version
codex	eq	1.2.2
codex	eq	1.3.1
codex	eq	1.2.2-signed
codex	eq	1.2.1
codex	eq	1.3.0

References

github.com/jcv8000/Codex

github.com/jcv8000/Codex/issues/8

github.com/jcv8000/Codex/releases/tag/v1.4.1