{"id":"GHSA-5pqx-77vf-85rw","aliases":["CVE-2021-30458"],"title":"Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.","severity":"medium","score":6.1,"published":"2022-05-24T17:47:02.000Z","modified":"2024-06-07T22:29:02.090Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"wikimedia/parsoid","ranges":[{"events":[{"introduced":"0.12"},{"fixed":"0.12.2"}],"type":"ECOSYSTEM"}],"versions":["v0.12.0","v0.12.0-a1","v0.12.0-a10","v0.12.0-a11","v0.12.0-a12","v0.12.0-a13","v0.12.0-a14","v0.12.0-a15","v0.12.0-a16","v0.12.0-a17","v0.12.0-a18","v0.12.0-a19","v0.12.0-a2","v0.12.0-a20","v0.12.0-a21","v0.12.0-a22","v0.12.0-a23","v0.12.0-a3","v0.12.0-a4","v0.12.0-a5","v0.12.0-a6","v0.12.0-a7","v0.12.0-a8","v0.12.0-a9","v0.12.1"],"fixed":["0.12.2"]},{"ecosystem":"Packagist","name":"wikimedia/parsoid","ranges":[{"events":[{"introduced":"0"},{"fixed":"0.11.1"}],"type":"ECOSYSTEM"}],"versions":["v0.11.0"],"fixed":["0.11.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-30458","https://github.com/FriendsOfPHP/security-advisories/blob/master/wikimedia/parsoid/CVE-2021-30458.yaml","https://github.com/wikimedia/mediawiki-services-parsoid","https://phabricator.wikimedia.org/T279451","https://security.gentoo.org/glsa/202107-40","https://www.mediawiki.org/wiki/Parsoid"],"sources":[{"name":"OSV","id":"GHSA-5pqx-77vf-85rw","modified":"2024-06-07T22:29:02.090533Z","url":"https://osv.dev/vulnerability/GHSA-5pqx-77vf-85rw"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}