CVE-2021-23439

MEDIUM

file-upload-with-preview < 4.2.0 - Stored Cross-Site Scripting via Filename

Title source: llm

Description

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).

References (3)

Core 3

Core References

Third Party Advisory x_refsource_misc

https://snyk.io/vuln/SNYK-JS-FILEUPLOADWITHPREVIEW-1579492

Broken Link x_refsource_misc

https://github.com/johndatserakis/file-upload-with-preview/blob/develop/src/file-upload-with-preview.js%23L168

Patch, Third Party Advisory x_refsource_misc

https://github.com/johndatserakis/file-upload-with-preview/pull/40/files?file-filters%5B%5D=.js&hide-deleted-files=true%23diff-fe47b243de17419c0daa22cd785cd754baed60cf3679d3da1d6fe006f9f4a7f0R174

Scores

CVSS v3 4.2

EPSS 0.0089

EPSS Percentile 55.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

johndatserakis/file-upload-with-preview < 4.2.0

npm/file-upload-with-preview 0 - 4.2.0npm

Published Sep 05, 2021

Tracked Since Feb 18, 2026