CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2021-27671
Medium (6.1) in comrak project comrak. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in comrak 0.9.1.
An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- comrak_project:comrak
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xmr7-v725-2jjr | crates.io | comrak | <0.9.1 | 0.9.1 |
| RUSTSEC-2021-0026 | crates.io | comrak | >=0.0.0-0 <0.9.1 | 0.9.1 |