CVE-2021-28079

MEDIUM

jamovi <= 1.6.18 - Stored Cross-Site Scripting via Column Name in .omv File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-28079. PoCs published by g33xter.

AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2021-28079, an XSS vulnerability in Jamovi <=1.6.18. The exploit involves crafting a malicious .omv file with an XSS payload in the metadata.json file, which executes when opened by the victim.

Description

Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered.

Exploits (1)

nomisec WORKING POC 4 stars
by g33xter · poc
https://github.com/g33xter/CVE-2021-28079

This repository provides a functional proof-of-concept for CVE-2021-28079, an XSS vulnerability in Jamovi <=1.6.18. The exploit involves crafting a malicious .omv file with an XSS payload in the metadata.json file, which executes when opened by the victim.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Moderate
Reliability
Reliable
Target: Jamovi <=1.6.18
No auth needed
Prerequisites: Ability to deliver a malicious .omv file to the victim · Victim must open the file in Jamovi
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory x_refsource_misc
https://www.jamovi.org

Scores

CVSS v3 6.1
EPSS 0.0215
EPSS Percentile 84.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
jamovi/jamovi < 1.6.18
Published Apr 26, 2021
Tracked Since Feb 18, 2026