{"id":"GHSA-5pqx-77vf-85rw","summary":"Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)","details":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","aliases":["CVE-2021-30458"],"modified":"2024-06-07T22:29:02.090533Z","published":"2022-05-24T17:47:02Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-06-07T22:12:19Z","nvd_published_at":"2021-04-09T07:15:00Z","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30458"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/wikimedia/parsoid/CVE-2021-30458.yaml"},{"type":"PACKAGE","url":"https://github.com/wikimedia/mediawiki-services-parsoid"},{"type":"WEB","url":"https://phabricator.wikimedia.org/T279451"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202107-40"},{"type":"WEB","url":"https://www.mediawiki.org/wiki/Parsoid"}],"affected":[{"package":{"name":"wikimedia/parsoid","ecosystem":"Packagist","purl":"pkg:composer/wikimedia/parsoid"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12"},{"fixed":"0.12.2"}]}],"versions":["v0.12.0","v0.12.0-a1","v0.12.0-a10","v0.12.0-a11","v0.12.0-a12","v0.12.0-a13","v0.12.0-a14","v0.12.0-a15","v0.12.0-a16","v0.12.0-a17","v0.12.0-a18","v0.12.0-a19","v0.12.0-a2","v0.12.0-a20","v0.12.0-a21","v0.12.0-a22","v0.12.0-a23","v0.12.0-a3","v0.12.0-a4","v0.12.0-a5","v0.12.0-a6","v0.12.0-a7","v0.12.0-a8","v0.12.0-a9","v0.12.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5pqx-77vf-85rw/GHSA-5pqx-77vf-85rw.json"}},{"package":{"name":"wikimedia/parsoid","ecosystem":"Packagist","purl":"pkg:composer/wikimedia/parsoid"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1"}]}],"versions":["v0.11.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5pqx-77vf-85rw/GHSA-5pqx-77vf-85rw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}