CVE-2021-39205mediumCWE-1321CWE-79

CVE-2021-39205: medium-severity vulnerability in jitsi-meet

DOM-based XSS/Content Spoofing via Prototype Pollution

Published · Updated

Follow this CVE+ Monitor jitsi-meet

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 1.2%
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
jitsi · jitsi-meet
Related CVEs — jitsi-meet

In the same product, most dangerous first.

CVE-2021-39215HIGHAuthentication Bypass: Forged Tokens Allow Access to Arbitrary RoomsEPSS 1.2%CVE-2025-64754LOWJitsi Meet has DOM Redirect on Microsoft OAuth FlowEPSS 0.4%