CVE-2022-21650

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-21650

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21650.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-21650

Aliases

GHSA-mm2v-4v7g-m695

Published

2022-01-04T20:40:14Z

Modified

2026-04-10T04:43:58.420800Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CVSS Calculator

Summary

Stored XSS via html file upload in convos

Details

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21650.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/convos-chat/convos

Affected ranges

Type: GIT
Repo: https://github.com/convos-chat/convos
Events: Introduced

ac6561598373139c127d32bd7399a524ef17a76f

Fixed

794ab7d2273327829230bfa96b5b3126b0547bb1

Affected versions

v6.*

v6.48

v6.49

v6.50

v6.51

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21650.json"

Git / github.com/nordaaker/convos

Affected ranges

Type

GIT

Repo

https://github.com/nordaaker/convos

Events

Introduced

ac6561598373139c127d32bd7399a524ef17a76f

Fixed

794ab7d2273327829230bfa96b5b3126b0547bb1