CVE-2021-46888

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-46888
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-46888.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-46888
Aliases
Published
2023-05-21T20:15:09.240Z
Modified
2026-04-12T05:16:17.492826Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

References

Affected packages

Git / github.com/simonmichael/hledger

Affected ranges

Type
GIT
Repo
https://github.com/simonmichael/hledger
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
47b5b6be0d3f3fd42cf58508e28521d46b5bbb64
Database specific 
{
    "cpe": "cpe:2.3:a:hledger:hledger:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.23"
        }
    ],
    "source": [
        "CPE_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.13.0
0.14.0
0.15.0
0.15.2
0.16.0
0.16.1
0.17.0
0.18.0
0.18.1
0.18.2
0.19
0.19.1
0.19.3
0.2
0.20
0.20.0.1
0.21
0.21.1
0.21.2
0.21.3
0.22
0.3
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.8.0
0.9.0
1.*
1.18
1.19
1.20
1.21
1.22
Other
2013_switch_to_git
hledger-web-0_15_1
hledger-web-0_15_3
hledger-web-0_16_2
hledger-web-0_16_3
hledger-web-0_16_4
hledger-web-0_16_5
hledger-web-0_17_1
hledger-web-0_19
hledger-0.*
hledger-0.1
hledger-0.10.0
hledger-0.11.0
hledger-0.11.1
hledger-0.12.0
hledger-0.12.1
hledger-0.13.0
hledger-0.14.0
hledger-0.15.0
hledger-0.15.2
hledger-0.16.0
hledger-0.16.1
hledger-0.17.0
hledger-0.18.0
hledger-0.18.1
hledger-0.18.2
hledger-0.19
hledger-0.19.1
hledger-0.19.3
hledger-0.2
hledger-0.20
hledger-0.20.0.1
hledger-0.21
hledger-0.21.1
hledger-0.21.2
hledger-0.21.3
hledger-0.22
hledger-0.23
hledger-0.24
hledger-0.26
hledger-0.27
hledger-0.3
hledger-0.4.0
hledger-0.5.0
hledger-0.5.1
hledger-0.6.0
hledger-0.6.1
hledger-0.7.0
hledger-0.8.0
hledger-0.9.0
hledger-1.*
hledger-1.0
hledger-1.0.1
hledger-1.1
hledger-1.10
hledger-1.11
hledger-1.12
hledger-1.12.1
hledger-1.13
hledger-1.13.1
hledger-1.13.2
hledger-1.14
hledger-1.14.1
hledger-1.15
hledger-1.15.1
hledger-1.15.2
hledger-1.16
hledger-1.17
hledger-1.17-hackage
hledger-1.18
hledger-1.19
hledger-1.2
hledger-1.20
hledger-1.21
hledger-1.22
hledger-1.3
hledger-1.4
hledger-1.5
hledger-1.9
hledger-api-1.*
hledger-api-1.0
hledger-api-1.1
hledger-api-1.10
hledger-api-1.11
hledger-api-1.12
hledger-api-1.13
hledger-api-1.14
hledger-api-1.2
hledger-api-1.3
hledger-api-1.4
hledger-api-1.5
hledger-api-1.9
hledger-lib-0.*
hledger-lib-0.23
hledger-lib-0.24
hledger-lib-0.26
hledger-lib-0.27
hledger-lib-1.*
hledger-lib-1.0
hledger-lib-1.0.1
hledger-lib-1.1
hledger-lib-1.10
hledger-lib-1.11
hledger-lib-1.12
hledger-lib-1.13
hledger-lib-1.13.1
hledger-lib-1.14
hledger-lib-1.15
hledger-lib-1.15.1
hledger-lib-1.15.2
hledger-lib-1.16
hledger-lib-1.17
hledger-lib-1.17-hackage
hledger-lib-1.17.0.1
hledger-lib-1.18
hledger-lib-1.19
hledger-lib-1.2
hledger-lib-1.20
hledger-lib-1.21
hledger-lib-1.22
hledger-lib-1.3
hledger-lib-1.4
hledger-lib-1.5
hledger-lib-1.9
hledger-ui-0.*
hledger-ui-0.27
hledger-ui-1.*
hledger-ui-1.0
hledger-ui-1.0.1
hledger-ui-1.0.2
hledger-ui-1.0.3
hledger-ui-1.0.4
hledger-ui-1.1
hledger-ui-1.10
hledger-ui-1.10.1
hledger-ui-1.11
hledger-ui-1.12
hledger-ui-1.12.1
hledger-ui-1.13
hledger-ui-1.14
hledger-ui-1.15
hledger-ui-1.16
hledger-ui-1.17
hledger-ui-1.17-hackage
hledger-ui-1.18
hledger-ui-1.19
hledger-ui-1.2
hledger-ui-1.20
hledger-ui-1.21
hledger-ui-1.22
hledger-ui-1.3
hledger-ui-1.4
hledger-ui-1.5
hledger-ui-1.9
hledger-web-0.*
hledger-web-0.15.1
hledger-web-0.15.3
hledger-web-0.16.2
hledger-web-0.16.3
hledger-web-0.16.4
hledger-web-0.16.5
hledger-web-0.17.1
hledger-web-0.19
hledger-web-0.23
hledger-web-0.24
hledger-web-0.26
hledger-web-0.27
hledger-web-1.*
hledger-web-1.0
hledger-web-1.0.1
hledger-web-1.1
hledger-web-1.10
hledger-web-1.11
hledger-web-1.12
hledger-web-1.13
hledger-web-1.14
hledger-web-1.15
hledger-web-1.16
hledger-web-1.17
hledger-web-1.17-hackage
hledger-web-1.18
hledger-web-1.19
hledger-web-1.2
hledger-web-1.20
hledger-web-1.20.1
hledger-web-1.21
hledger-web-1.22
hledger-web-1.3
hledger-web-1.4
hledger-web-1.5
hledger-web-1.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-46888.json"