CVE-2021-43842

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5.257 and earlier are vulnerable to stored cross-site scripting through a SVG file upload. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. Commit 5d3e81496fba1f0fbd64eeb855f30f69a9040718 fixes this vulnerability by adding an optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround, disable file upload for all non-trusted users. Wiki.js version 2.5.260 is the first production version to contain a patch. Version 2.5.258 is the first development build to contain a patch and is available only as a Docker image as requarks/wiki:canary-2.5.258.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Requarks	wiki	< 2.5.258 (development); < 2.5.260 (production)

References

https://github.com/Requarks/wiki/commit/5d3e81496fba1f0fbd64eeb855f30f69a9040718Patch, Third Party Advisory
https://github.com/Requarks/wiki/releases/tag/2.5.260Release Notes, Third Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-3qv4-gp35-rgh7Patch, Third Party Advisory
https://github.com/Requarks/wiki/commit/5d3e81496fba1f0fbd64eeb855f30f69a9040718Patch, Third Party Advisory
https://github.com/Requarks/wiki/releases/tag/2.5.260Release Notes, Third Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-3qv4-gp35-rgh7Patch, Third Party Advisory

Timeline

Published: Dec 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-438437.5jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 i CVE-2021-438448.8MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0.CVE-2021-438459.1PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, th CVE-2021-438464.3`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and CVE-2021-438476.5HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered use CVE-2021-438485.9h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC CVE-2021-438495.5cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS.CVE-2021-43854.3The WP Private Content Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is CVE-2021-438506.8Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via CVE-2021-438518.8Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple file CVE-2021-438528.8OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject pr CVE-2021-438535.4Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to Ja