{"id":"GHSA-f34m-x9pj-62vq","summary":"Cross-Site Scripting Vulnerability in @joeattardi/emoji-button","details":"### Impact\n\nThere are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:\n\n- A URL for a custom emoji\n- An i18n string\n\nIn both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.\n\n### Patches\n\nThis vulnerability is fixed starting in version 4.6.2. This is resolved by properly escaping strings that are inserted into the HTML document.\n\n### Workarounds\n\nThere is no workaround other than upgrading to a non-vulnerable version.\n\n### Credit\n\nThis issue was discovered by GitHub team member [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh) and was reported by the GitHub Security Lab team.","aliases":["CVE-2021-43785"],"modified":"2026-07-08T06:27:44.662091967Z","published":"2021-12-01T18:29:02Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-11-29T20:21:36Z","nvd_published_at":"2021-11-26T19:15:00Z"},"references":[{"type":"WEB","url":"https://github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43785"},{"type":"WEB","url":"https://github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16"},{"type":"WEB","url":"https://github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e"},{"type":"PACKAGE","url":"https://github.com/joeattardi/emoji-button"}],"affected":[{"package":{"name":"@joeattardi/emoji-button","ecosystem":"npm","purl":"pkg:npm/%40joeattardi/emoji-button"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.6.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-f34m-x9pj-62vq/GHSA-f34m-x9pj-62vq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"}]}