Skip to content
Sign in
6.5 Medium

CVE-2021-23824 This affects the package Crow before 0.3+4

Description

This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

Affected products and versions

Product Affected versions Fixed in
Crow 0.3 earliest → < 0.3+4 0.3+4

Other CVEs of Crow

The 3 CVEs of Crow →
CVE-2023-26142 All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build… 6.5 Medium CVE-2021-23514 This affects the package Crow before 0.3+4 6.5 Medium
Track this CVE