PT-2021-23931 · Unknown · @Joeattardi/Emoji-Button

Erik Krogh Kristensen + 1 · Published 2021-11-26 · Updated 2021-12-01 · CVE-2021-43785

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: @joeattardi/emoji-button versions prior to 4.6.2

Description: The issue concerns two vectors for XSS attacks: a URL for a custom emoji and an i18n string. In both cases, a crafted value can insert a script tag into the page and execute malicious code.

Recommendations: For versions prior to 4.6.2, upgrade to version 4.6.2 or later, which properly escapes strings inserted into the HTML document to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43785

GHSA-F34M-X9PJ-62VQ

Affected Products

@Joeattardi/Emoji-Button

References · 7

• https://github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16 · Patch
• https://github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e · Patch
• https://osv.dev/vulnerability/CVE-2021-43785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43785 · Security Note
• https://osv.dev/vulnerability/GHSA-f34m-x9pj-62vq · Vendor Advisory
• https://github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq · Note
• https://github.com/joeattardi/emoji-button · Note