CVE-2021-23414

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 28, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-234157.5This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create aCVE-2021-234166.1This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.CVE-2021-234179.8All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.CVE-2021-234189.8The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, whiCVE-2021-234199.8This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototypCVE-2021-23424.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.34 anCVE-2021-234209.8This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadgCVE-2021-234219.8All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.CVE-2021-234227.8This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is proceCVE-2021-234237.5This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-rawCVE-2021-234247.5This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an exCVE-2021-234255.3All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
CVE-2021-23414: Medium severity, CVSS 6.1 | Vulnix