CVE-2021-47963

5.1 mediumEPSS 0.5%

Medium (5.1). EPSS 0.5% chance of exploitation in the next 30 days.

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application. Attackers can craft malicious markdown files with embedded JavaScript that executes system commands when opened, enabling remote code execution on the victim's computer.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-05-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/AnotherNote/anote
https://www.exploit-db.com/exploits/49836
https://www.vulncheck.com/advisories/anote-persistent-cross-site-scripting-remote-code-execution

Check your stack JSON