cve.bz

CVE-2021-29438

5.4 mediumEPSS 0.7%

Medium (5.4) in nextcloud\/dialogs project nextcloud\/dialogs. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in @nextcloud/dialogs 3.1.2.

The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.

Severity

CVSS 3.1

5.4 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWEs
CWE-79, CWE-80
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g3fq-3v3g-mh32npm@nextcloud/dialogs<3.1.23.1.2

References

Check your stackJSON