CVE-2021-32851mediumCWE-79

CVE-2021-32851: medium-severity vulnerability in npm mind-elixir

jQuery MiniColors vulnerable to Cross-site Scripting

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.7%
exploitation probability
0.7%top 48% of all CVEs
observed exploitation
nono source reports it
In short

jQuery MiniColors plugin fails to properly sanitize user input in color values, allowing attackers to inject malicious JavaScript code that executes in the browser of anyone viewing the affected page. This can lead to theft of sensitive data or unauthorized actions on behalf of users.

Technical detail

Cross-site scripting vulnerability in jQuery MiniColors color input handling due to insufficient input validation. An attacker can inject malicious script through untrusted menu data, which executes in the victim's browser context with the privileges of the vulnerable application. Exploitation requires user interaction with crafted color input.

Summary generated and translated by AI from the official description.
Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue is patched in version 0.18.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
npm · mind-elixir
References
https://github.com/ssshooter/mind-elixir-core/blob/79942a68b14c8875ab7d270b1ad25bfff351b04c/src/plugin/contextMenu.js#L13https://github.com/ssshooter/mind-elixir-core/commit/073485269ac83af24371f35bd08507defa885655https://securitylab.github.com/advisories/GHSL-2021-1047_Mind-elixir/