CVE-2021-43785
HIGHemoji-button < 4.6.2 - Cross-Site Scripting via Custom Emoji URL or i18n String
Title source: llmDescription
@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.
References (3)
Core 3
Core References
Third Party Advisory x_refsource_confirm
https://github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq
Patch, Third Party Advisory x_refsource_misc
https://github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16
Patch, Third Party Advisory x_refsource_misc
https://github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e
Scores
CVSS v3
7.6
EPSS
0.0101
EPSS Percentile
59.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Details
CWE
CWE-79
Status
published
Products (2)
emoji_button_project/emoji_button
< 4.6.2
joeattardi/emoji-button
0 - 4.6.2npm
Published
Nov 26, 2021
Tracked Since
Feb 18, 2026