Every CVE Search/ Get API key

CVE-2017-18635

Cross-Site Scripting in @novnc/novnc

6.1 MediumPublic exploitFix available

CVE-2017-18635 is a medium vulnerability (CVSS 6.1) in Novnc, published September 25, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.79%, the 91st percentile. Fixed in @novnc/novnc 0.6.2.

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

4.79%Down 4.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Record
CVE-2017-18635
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Record
CVE-2017-18635
Updated
2026-11-02
EUVDEUVD-2020-0588 No score

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Record
EUVD-2020-0588
Updated
2026-11-03
GitHub AdvisoriesGHSA-49rv-g7w5-m8xx 6.1

Cross-Site Scripting in @novnc/novnc

Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of include/ui.js and users of vnc_auto.html and vnc.html.

Recommendation

Upgrade to version 0.6.2 or later.

Record
GHSA-49rv-g7w5-m8xx
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Record
CVE-2017-18635
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-18635 6.1

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Record
DEBIAN-CVE-2017-18635
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-49rv-g7w5-m8xx 6.1

Cross-Site Scripting in @novnc/novnc

Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of include/ui.js and users of vnc_auto.html and vnc.html.

Recommendation

Upgrade to version 0.6.2 or later.

Record
GHSA-49rv-g7w5-m8xx
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVRHSA-2020:0754 6.1

Red Hat Security Advisory: novnc security update

Record
RHSA-2020:0754
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2020:3247 8.1

Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update

Record
RHSA-2020:3247
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-18635 6.1

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

Record
UBUNTU-CVE-2017-18635
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2020-0374 No score

Updated novnc package fixes a security vulnerability

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name. (CVE-2017-18635)

Record
MGASA-2020-0374
Updated
2026-11-02
OSVUSN-4522-1 No score

novnc vulnerability

It was discovered that noVNC did not properly manage certain messages, resulting in the remote VNC server injecting arbitrary HTML into the noVNC web page. An attacker could use this issue to conduct cross-site scripting (XSS) attacks. (CVE-2017-18635)

Record
USN-4522-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@novnc/novnc
npm
 before 0.6.2
0.6.2
novnc
Debian:12
 before 1:1.0.0-1
1:1.0.0-1
novnc
Debian:13
 before 1:1.0.0-1
1:1.0.0-1
novnc
Debian:14
 before 1:1.0.0-1
1:1.0.0-1
novnc
Debian:8
 before 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1, plus listed versions
1:0.4+dfsg+1+20131010+gitf68af8af3d-4
1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1
novnc
Debian:9
 before 1:0.4+dfsg+1+20131010+gitf68af8af3d-6+deb9u1, plus listed versions
1:0.4+dfsg+1+20131010+gitf68af8af3d-6
1:0.4+dfsg+1+20131010+gitf68af8af3d-6+deb9u1
novnc
Mageia:7
 before 0.5.1-2.1.mga7
0.5.1-2.1.mga7
novnc
Red Hat:openstack:13::el7
 before 0:1.1.0-2.el7ost
0:1.1.0-2.el7ost
novnc
Red Hat:rhev_manager:4.4:el8
 before 0:1.1.0-1.el8ost
0:1.1.0-1.el8ost
ovirt-engine
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
Show 24 moreShow less
Affected packages
PackageAffectedFixed
ovirt-engine-api-explorer
Red Hat:rhev_manager:4.4:el8
 before 0:0.0.6-1.el8ev
0:0.0.6-1.el8ev
ovirt-engine-backend
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-dbscripts
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-health-check-bundler
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-restapi
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup-base
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup-plugin-cinderlib
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup-plugin-imageio
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup-plugin-ovirt-engine
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup-plugin-ovirt-engine-common
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup-plugin-vmconsole-proxy-helper
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-setup-plugin-websocket-proxy
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-tools
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-tools-backup
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-vmconsole-proxy-helper
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-webadmin-portal
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
ovirt-engine-websocket-proxy
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
python3-ovirt-engine-lib
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
rhvm
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.1.8-0.7.el8ev
0:4.4.1.8-0.7.el8ev
rhvm-dependencies
Red Hat:rhev_manager:4.4:el8
 before 0:4.4.0-1.el8ev
0:4.4.0-1.el8ev
ovirt-engine-ui-extensions
Red Hat:rhev_manager:4.4:el8
 before 0:1.2.2-1.el8ev
0:1.2.2-1.el8ev
novnc
Ubuntu:16.04:LTS
 before 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1build0.16.04.1, plus listed versions
1:0.4+dfsg+1+20131010+gitf68af8af3d-4
1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1build0.16.04.1
novnc
Ubuntu:18.04:LTS
 All versions, plus listed versions
1:0.4+dfsg+1+20131010+gitf68af8af3d-61:0.4+dfsg+1+20131010+gitf68af8af3d-7
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubShielderSec/CVE-2017-186352019-10-16

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 95 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open