CVE-2021-29438

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80

Affected software

Vendor	Product	Versions
nextcloud	nextcloud-dialogs	< 3.1.2

References

Timeline

Published: Apr 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294397.2The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `a CVE-2021-294407.2Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to CVE-2021-294419.8Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when con CVE-2021-294427.5Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the Conf CVE-2021-294435.9jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A1 CVE-2021-294445.9jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 CVE-2021-294455.9jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA CVE-2021-294465.9jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA CVE-2021-294476.5Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Libr CVE-2021-294488.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal,CVE-2021-294497.8Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Multiple privilege escalation vulnerabilities were CVE-2021-294504.3Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a