Every CVE Search/ Get API key

CVE-2021-33391

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option...

9.8 CriticalFix available

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.13%Down 1.4 points since Feb 18, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
CVE-2021-33391
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
CVE List 9.8

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
CVE-2021-33391
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2021-20097 9.8

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
EUVD-2021-20097
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-wfrp-xv2m-8j85 9.8

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option...

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
GHSA-wfrp-xv2m-8j85
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVAZL-13687 9.8

CVE-2021-33391 affecting package tidy for versions less than 5.8.0-6

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
AZL-13687
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-35324 9.8

CVE-2021-33391 affecting package tidy for versions less than 5.8.0-6

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
AZL-35324
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
Show 6 moreShow less
OSV 9.8

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
CVE-2021-33391
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-33391 9.8

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
DEBIAN-CVE-2021-33391
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1017 9.8

tidy security update

When editing HTML it's easy to make mistakes. Wouldn't it be nice if there was a simple way to fix these mistakes automatically and tidy up sloppy editing into nicely laid out markup? Well now there is! Dave Raggett's HTML TIDY is a free utility for doing just that. It also works great on the atrociously hard to read markup generated by specialized HTML editors and conversion tools, and can help you identify where you need to pay further attention on making your pages more accessible to people with disabilities.

Security Fix(es):

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.(CVE-2021-33391)

Record
OESA-2024-1017
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1073 9.8

tidy security update

When editing HTML it's easy to make mistakes. Wouldn't it be nice if there was a simple way to fix these mistakes automatically and tidy up sloppy editing into nicely laid out markup? Well now there is! Dave Raggett's HTML TIDY is a free utility for doing just that. It also works great on the atrociously hard to read markup generated by specialized HTML editors and conversion tools, and can help you identify where you need to pay further attention on making your pages more accessible to people with disabilities.

Security Fix(es):

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.(CVE-2021-33391)

Record
OESA-2024-1073
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-33391 9.8

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Record
UBUNTU-CVE-2021-33391
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-6483-1 No score

tidy-html5 vulnerability

Neeraj Pal discovered that HTML Tidy incorrectly handled parsing certain HTML data. If a user or automated system were tricked into parsing specially crafted HTML data, a remote attacker could cause HTML Tidy to consume resources, leading to a denial of service, or possibly execute arbitrary code.

Record
USN-6483-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tidy
Azure Linux:2
 before 5.8.0-6
5.8.0-6
tidy
Azure Linux:3
 before 5.8.0-6
5.8.0-6
tidy-html5
Debian:12
 All versions, plus listed versions
2:5.6.0-112:5.7.45-1~exp12:5.8.0-12:5.8.0-1~exp12:5.8.0-1~exp22:5.8.0-22:5.8.0-2.1
 None known
tidy-html5
Debian:13
 before 2:5.8.0-2
2:5.8.0-2
tidy-html5
Debian:14
 before 2:5.8.0-2
2:5.8.0-2
tidy
openEuler:20.03-LTS-SP1
 before 5.6.0-5.oe1
5.6.0-5.oe1
tidy
openEuler:20.03-LTS-SP3
 before 5.6.0-5.oe1
5.6.0-5.oe1
tidy
openEuler:20.03-LTS-SP4
 before 5.6.0-5.oe2003sp4
5.6.0-5.oe2003sp4
tidy
openEuler:22.03-LTS
 before 5.7.28-2.oe2203sp2
5.7.28-2.oe2203sp2
tidy
openEuler:22.03-LTS-SP1
 before 5.7.28-2.oe2203sp1
5.7.28-2.oe2203sp1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
tidy
openEuler:22.03-LTS-SP2
 before 5.7.28-2.oe2203sp2
5.7.28-2.oe2203sp2
tidy
openEuler:22.03-LTS-SP3
 before 5.7.28-2.oe2203sp3
5.7.28-2.oe2203sp3
tidy-html5
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:5.2.0-2
 None known
tidy-html5
Ubuntu:20.04:LTS
 before 2:5.6.0-11ubuntu0.20.04.1, plus listed versions
2:5.6.0-102:5.6.0-11
2:5.6.0-11ubuntu0.20.04.1
tidy-html5
Ubuntu:22.04:LTS
 before 2:5.6.0-11ubuntu0.22.04.1, plus listed versions
2:5.6.0-11build12:5.6.0-11build2
2:5.6.0-11ubuntu0.22.04.1
tidy-html5
Ubuntu:24.04:LTS
 before 2:5.6.0-11ubuntu1, plus listed versions
2:5.6.0-11build2
2:5.6.0-11ubuntu1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-33391 is a critical vulnerability (CVSS 9.8) in Htacg Tidy, published February 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in tidy 5.8.0-6.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open