CVE-2021-23414 — Cross-site Scripting in Video.js

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.6%
top 31.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Videojs Video.jsFedoraproject Fedora
Timeline
PublishedJul 28
Latest updateDec 9

Description

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5videojs/video.jsunspecified — 7.14.3
▶NVDvideojs/video.js< 7.14.3
▶npmvideojs/video.js< 7.14.3

Also affects: Fedora 35, 36, 37

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Cross-site Scripting in video.js↗2021-08-10
▶
OSV
Cross-site Scripting in video.js↗2021-08-10
▶

📋Vendor Advisories

1
CISA ICS
Festo LX Appliance↗2025-12-09
▶
CVE-2021-23414 — Cross-site Scripting in Video.js | cvebase