{"id":"CVE-2021-20066","aliases":["EUVD-2022-3683","GHSA-f4c9-cqv8-9v98","UBUNTU-CVE-2021-20066"],"status":"published","title":"Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom","description":"JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.0145,"percentile":0.73741,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1220"],"published":"2021-02-16T19:48:08Z","modified":"2026-10-17T12:56:58Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-jsdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.10+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-jsdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.4.0+~cs77.17.35-3","18.0.1+~cs89.11.26-1","18.1.0+~cs90.11.25-1","18.1.1+~cs90.11.25-1","19.0.0+~cs90.11.27-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-jsdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.0.3+~cs124.18.21-1","20.0.3+~cs124.18.21-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-jsdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.0.3+~cs124.18.21-4","20.0.3+~cs124.18.21-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-jsdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.0.3+~cs124.18.21-6","20.0.3+~cs124.18.21-10build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-jsdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.0.3+~cs124.18.21-5","20.0.3+~cs124.18.21-6"]}],"products":[{"vendor":"jsdom_project","product":"jsdom"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2021-05","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/jsdom/jsdom/issues/3124#issuecomment-783502951","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20066","tags":["advisory"]},{"url":"https://github.com/jsdom/jsdom/issues/3124","tags":["web","report"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-JSDOM-1075447","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f4c9-cqv8-9v98"},{"url":"https://github.com/jsdom/jsdom","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-20066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20066","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-20066","description":"JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.","status":"published","published":"2021-02-16T19:48:08Z","modified":"2024-08-03T17:30:07.411Z","updated_at":"2026-11-02T14:32:55.564736Z"}],"euvd":[{"id":"EUVD-2022-3683","description":"JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.","status":"published","published":"2021-02-16T19:48:08Z","modified":"2024-08-03T17:30:07Z","updated_at":"2026-11-03T03:25:09.355483Z"}],"ghsa":[{"id":"GHSA-f4c9-cqv8-9v98","title":"Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom","description":"# Withdrawn Advisory\n\nThis advisory has been withdrawn because the user must configure jsdom to allow access to local files.\n\n# Original Description\n\nJSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.","status":"withdrawn","published":"2022-05-24T17:42:20Z","modified":"2024-07-19T18:34:32Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:37:56.530214Z"}],"nvd":[{"id":"CVE-2021-20066","description":"JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.","status":"published","published":"2021-02-16T20:15:15.767Z","modified":"2026-06-17T03:33:13.037Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"GHSA-f4c9-cqv8-9v98","title":"Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom","description":"# Withdrawn Advisory\n\nThis advisory has been withdrawn because the user must configure jsdom to allow access to local files.\n\n# Original Description\n\nJSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.","status":"withdrawn","published":"2022-05-24T17:42:20Z","modified":"2026-09-10T03:49:22.212015746Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2021-20066","description":"JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.","status":"published","published":"2021-02-16T20:15:00Z","modified":"2026-10-17T12:56:58.404053766Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"}]}}