CVE-2021-23961 affects multiple packages. Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. See references for individual vulnerability details.