CVE-2021-23422

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 16, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-234237.5This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-rawCVE-2021-234247.5This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an exCVE-2021-234255.3All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.CVE-2021-234267.5This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveragingCVE-2021-234279.8This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extractionCVE-2021-234289.8This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing CVE-2021-234297.5All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled witCVE-2021-23434.3Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that aCVE-2021-234307.5All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.CVE-2021-234318.8The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.CVE-2021-234329.8This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()CVE-2021-234339.8The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters
CVE-2021-23422: High severity, CVSS 7.8 | Vulnix