CVE-2021-29438: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast, explicitly pass the options.isHTML config flag.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29438?
The severity of CVE-2021-29438 is considered to be high due to the potential for XSS attacks.
How do I fix CVE-2021-29438?
To fix CVE-2021-29438, update the @nextcloud/dialogs package to version 3.1.2 or later.
What are the potential impacts of CVE-2021-29438?
CVE-2021-29438 can lead to cross-site scripting (XSS) vulnerabilities if user-supplied input is not properly escaped.
Is my application affected by CVE-2021-29438?
Your application may be affected by CVE-2021-29438 if it uses the @nextcloud/dialogs package version below 3.1.2 and displays user-supplied input in toasts.
What is the nature of the vulnerability in CVE-2021-29438?
CVE-2021-29438 is an XSS vulnerability caused by insufficiently escaping user input in toast notifications.