PT-2021-22436 · Vercel · Vercel

Styfle · Published 2021-08-30 · Updated 2021-09-08 · CVE-2021-39178

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Next.js versions 10.0.0 through 11.0.0

Description Next.js is a React framework that contains a cross-site scripting issue. For an instance to be affected, the next.config.js file must have the images.domains array assigned, and the image host in images.domains must allow user-provided SVG. The instance is not affected if the next.config.js file has images.loader assigned to something other than default or if it is deployed on Vercel.

Recommendations For Next.js versions 10.0.0 through 11.0.0, update to version 11.1.1 to resolve the issue. As a temporary workaround, consider modifying the next.config.js file to assign images.loader to something other than default, or restrict the use of user-provided SVG in the images.domains array until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-39178

GHSA-9GR3-7897-PP7M

Affected Products

Vercel

References · 10

• https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m · Patch
• https://github.com/vercel/next.js/releases/tag/v11.1.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39178 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39178 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gr3-7897-pp7m · Vendor Advisory
• https://github.com/vercel/next.js · Note
• https://github.com/vercel/next.js/pull/28620 · Note
• https://github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa · Note
• https://t.me/cvenotify/20410 · Telegram Post
• https://t.me/cibsecurity/28056 · Telegram Post