PT-2023-12608 · Unknown+1 · Hledger-Web+1

Gaspard Baye

·

Published

2023-05-21

·

Updated

2025-11-14

·

CVE-2021-46888

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions hledger versions prior to 1.23 hledger-web versions prior to 1.23
Description A Stored Cross-Site Scripting (XSS) issue exists in the toBloodhoundJson function, allowing an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function. The hledger-web forms sanitize obvious JavaScript but not obfuscated JavaScript, making instances, especially anonymously-writable ones, vulnerable to malicious JavaScript execution by subsequent visitors.
Recommendations For hledger versions prior to 1.23, update to version 1.23 or later to resolve the issue. For hledger-web versions prior to 1.23, update to version 1.23 or later to resolve the issue. As a temporary workaround, consider disabling the toBloodhoundJson function until a patch is available. Restrict access to anonymously-writable hledger-web instances to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-46888
HSEC-2023-0008

Affected Products

Ledger
Hledger-Web