CVE-2021-30458: XSS
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.
Other sources
Parsoid comment fostering allows for inserting mostly arbitrary <meta> tags
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-30458?
CVE-2021-30458 is considered a high severity vulnerability due to its potential for allowing cross-site scripting (XSS).
How do I fix CVE-2021-30458?
To mitigate CVE-2021-30458, update Wikimedia Parsoid to version 0.11.1 or 0.12.2 or later.
What software is affected by CVE-2021-30458?
CVE-2021-30458 affects Wikimedia Parsoid versions before 0.11.1 and 0.12.x before 0.12.2.
What type of vulnerability is CVE-2021-30458?
CVE-2021-30458 is a cross-site scripting (XSS) vulnerability stemming from inadequate sanitization of user input.
Can an attacker exploit CVE-2021-30458 remotely?
Yes, an attacker can exploit CVE-2021-30458 remotely by sending crafted wikitext.