GHSA-g3fq-3v3g-mh32

Source

https://github.com/advisories/GHSA-g3fq-3v3g-mh32

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-g3fq-3v3g-mh32/GHSA-g3fq-3v3g-mh32.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g3fq-3v3g-mh32

Aliases

CVE-2021-29438

Published

2021-04-16T19:52:58Z

Modified

2026-07-08T06:28:13Z

Severity

4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs

Details

Impact

The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability.

Note: Nextcloud Server employs a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities.

Patches

The vulnerability has been patched in version 3.1.2. If you need to display HTML in the toast, explicitly pass the options.isHTML config flag.

Workarounds

Make sure no user-supplied input flows into toasts.

Database specific

{
    "cwe_ids":  [
        "CWE-79",
        "CWE-80"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-04-13T18:40:52Z",
    "nvd_published_at":  "2021-04-13T20:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / @nextcloud/dialogs

Package

Name: @nextcloud/dialogs; View open source insights on deps.dev
Purl: pkg:npm/%40nextcloud/dialogs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-g3fq-3v3g-mh32/GHSA-g3fq-3v3g-mh32.json"