CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2021-23414
Medium (6.1). EPSS 2.5% chance of exploitation in the next 30 days. Fixed in video.js 7.14.3.
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Severity
- EPSS
- 2.5% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- videojs:video.js
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pp7m-6j83-m7r6 | npm | video.js | <7.14.3 | 7.14.3 |
References
- https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588