6.5
Medium
CVE-2021-23414 This affects the package video.js before 7.14.3
Description
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| video.js 7.14 | earliest → < 7.14.3 | 7.14.3 |