{"id":"CVE-2021-46888","details":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.","aliases":["HSEC-2023-0008"],"modified":"2026-09-17T14:15:00.215284Z","published":"2023-05-21T20:15:09.240Z","references":[{"type":"ADVISORY","url":"https://github.com/simonmichael/hledger/releases/tag/1.23"},{"type":"REPORT","url":"https://github.com/simonmichael/hledger/issues/1525"},{"type":"FIX","url":"https://github.com/simonmichael/hledger/pull/1663"},{"type":"EVIDENCE","url":"https://www.youtube.com/watch?v=QnRO-VkfIic"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hledgerorg/hledger","events":[{"introduced":"0"},{"fixed":"47b5b6be0d3f3fd42cf58508e28521d46b5bbb64"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:hledger:hledger:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.23"}]}}],"versions":["hledger-web-1.22","hledger-ui-1.22","hledger-lib-1.22","hledger-1.22","1.22","hledger-web-1.21","hledger-ui-1.21","hledger-lib-1.21","hledger-1.21","1.21","1.20","hledger-web-1.20.1","hledger-web-1.20","hledger-ui-1.20","hledger-lib-1.20","hledger-1.20","hledger-web-1.19","hledger-ui-1.19","hledger-lib-1.19","hledger-1.19","1.19","1.18","hledger-web-1.18","hledger-ui-1.18","hledger-lib-1.18","hledger-1.18","hledger-lib-1.17.0.1","hledger-web-1.17","hledger-ui-1.17","hledger-lib-1.17","hledger-1.17","hledger-web-1.17-hackage","hledger-ui-1.17-hackage","hledger-lib-1.17-hackage","hledger-1.17-hackage","hledger-web-1.16","hledger-ui-1.16","hledger-lib-1.16","hledger-1.16","hledger-lib-1.15.2","hledger-1.15.2","hledger-lib-1.15.1","hledger-1.15.1","hledger-web-1.15","hledger-ui-1.15","hledger-lib-1.15","hledger-1.15","hledger-1.14.1","hledger-web-1.14","hledger-ui-1.14","hledger-lib-1.14","hledger-api-1.14","hledger-1.14","hledger-1.13.2","hledger-lib-1.13.1","hledger-1.13.1","hledger-web-1.13","hledger-ui-1.13","hledger-lib-1.13","hledger-api-1.13","hledger-1.13","hledger-ui-1.12.1","hledger-1.12.1","hledger-web-1.12","hledger-ui-1.12","hledger-lib-1.12","hledger-api-1.12","hledger-1.12","hledger-web-1.11","hledger-ui-1.11","hledger-lib-1.11","hledger-api-1.11","hledger-1.11","hledger-ui-1.10.1","hledger-web-1.10","hledger-ui-1.10","hledger-lib-1.10","hledger-api-1.10","hledger-1.10","hledger-web-1.9","hledger-ui-1.9","hledger-lib-1.9","hledger-api-1.9","hledger-1.9","hledger-web-1.5","hledger-ui-1.5","hledger-lib-1.5","hledger-api-1.5","hledger-1.5","hledger-web-1.4","hledger-ui-1.4","hledger-lib-1.4","hledger-api-1.4","hledger-1.4","hledger-web-1.3","hledger-ui-1.3","hledger-lib-1.3","hledger-api-1.3","hledger-1.3","hledger-web-1.2","hledger-ui-1.2","hledger-lib-1.2","hledger-api-1.2","hledger-1.2","hledger-web-1.1","hledger-ui-1.1","hledger-lib-1.1","hledger-api-1.1","hledger-1.1","hledger-ui-1.0.4","hledger-ui-1.0.3","hledger-ui-1.0.2","hledger-web-1.0.1","hledger-ui-1.0.1","hledger-lib-1.0.1","hledger-1.0.1","hledger-web-1.0","hledger-ui-1.0","hledger-lib-1.0","hledger-api-1.0","hledger-1.0","hledger-web-0.27","hledger-ui-0.27","hledger-lib-0.27","hledger-0.27","hledger-web-0.26","hledger-lib-0.26","hledger-0.26","hledger-web-0.24","hledger-lib-0.24","hledger-0.24","hledger-web-0.23","hledger-lib-0.23","hledger-0.23","hledger-0.22","0.22","hledger-0.21.3","0.21.3","hledger-0.21.2","0.21.2","hledger-0.21.1","0.21.1","hledger-0.21","0.21","hledger-0.20.0.1","0.20.0.1","hledger-0.20","0.20","2013_switch_to_git","hledger-0.19.3","0.19.3","hledger-web-0_19","hledger-web-0.19","hledger-0.19.1","0.19.1","hledger-0.19","0.19","hledger-0.18.2","0.18.2","hledger-0.18.1","0.18.1","hledger-0.18.0","0.18.0","hledger-web-0_17_1","hledger-web-0.17.1","hledger-0.17.0","0.17.0","hledger-web-0_16_5","hledger-web-0.16.5","hledger-web-0_16_4","hledger-web-0.16.4","hledger-web-0_16_3","hledger-web-0.16.3","hledger-web-0_16_2","hledger-web-0.16.2","hledger-0.16.1","0.16.1","hledger-0.16.0","0.16.0","hledger-web-0_15_3","hledger-web-0.15.3","hledger-0.15.2","0.15.2","hledger-web-0_15_1","hledger-web-0.15.1","hledger-0.15.0","0.15.0","hledger-0.14.0","0.14.0","hledger-0.13.0","0.13.0","hledger-0.12.1","0.12.1","hledger-0.12.0","0.12.0","hledger-0.11.1","0.11.1","hledger-0.11.0","0.11.0","hledger-0.10.0","0.10.0","hledger-0.9.0","0.9.0","hledger-0.8.0","0.8.0","hledger-0.7.0","0.7.0","hledger-0.6.1","0.6.1","hledger-0.6.0","0.6.0","hledger-0.5.1","0.5.1","hledger-0.5.0","0.5.0","hledger-0.4.0","0.4.0","hledger-0.3","0.3","hledger-0.2","0.2","hledger-0.1","0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-46888.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}