CVE-2021-43635

MEDIUM

Codex < 1.4.0 - Stored Cross-Site Scripting via Notebook/Page Name Field

Title source: llm

Description

A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.

References (3)

Core 3

Core References

Product, Third Party Advisory x_refsource_misc

https://github.com/jcv8000/Codex

View Writeup ZIP pw:eip

Exploit, Third Party Advisory x_refsource_misc

https://github.com/jcv8000/Codex/issues/8

Release Notes, Third Party Advisory x_refsource_misc

https://github.com/jcv8000/Codex/releases/tag/v1.4.1

Scores

CVSS v3 6.1

EPSS 0.0178

EPSS Percentile 75.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

codexnotes/codex < 1.4.0

Published Feb 04, 2022

Tracked Since Feb 18, 2026