CVE-2021-39205

6.1 mediumEPSS 1.2%

Medium (6.1) in 8x8 jitsi meet. EPSS 1.2% chance of exploitation in the next 30 days.

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-1321
Published: 2021-09-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

8x8:jitsi_meet

References

https://github.com/jitsi/jitsi-meet/pull/9320
https://github.com/jitsi/jitsi-meet/pull/9404
https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg
https://hackerone.com/reports/1214493
https://github.com/jitsi/jitsi-meet/pull/9320

Check your stack JSON