{"id":"CVE-2021-30458","aliases":["DEBIAN-CVE-2021-30458","EUVD-2022-2633","GHSA-5pqx-77vf-85rw","UBUNTU-CVE-2021-30458"],"status":"published","title":"Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00977,"percentile":0.62423,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-04-09T06:06:04Z","modified":"2026-10-24T10:31:04Z","fixes":[{"ecosystem":"Packagist","package":"wikimedia/parsoid","fixed_in":["0.12.2","0.11.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.35.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.35.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.35.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"wikimedia/parsoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12"},{"fixed":"0.12.2"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"wikimedia/parsoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.2-1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"wikimedia/parsoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12"},{"fixed":"0.12.2"}]}],"versions":["v0.12.0","v0.12.0-a1","v0.12.0-a10","v0.12.0-a11","v0.12.0-a12","v0.12.0-a13","v0.12.0-a14","v0.12.0-a15","v0.12.0-a16","v0.12.0-a17","v0.12.0-a18","v0.12.0-a19","v0.12.0-a2","v0.12.0-a20","v0.12.0-a21","v0.12.0-a22","v0.12.0-a23","v0.12.0-a3","v0.12.0-a4","v0.12.0-a5","v0.12.0-a6","v0.12.0-a7","v0.12.0-a8","v0.12.0-a9","v0.12.1"]},{"source":"osv","ecosystem":"Packagist","package":"wikimedia/parsoid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1"}]}],"versions":["v0.11.0"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.27.3-1","1:1.27.4-1","1:1.27.4-2","1:1.27.4-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1","1:1.31.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1","1:1.35.6-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1","1:1.39.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.1+dfsg-1","1:1.43.1+dfsg-2","1:1.43.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.8+dfsg-2","1:1.43.9+dfsg-1","1:1.43.9+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1","1:1.43.8+dfsg-2"]}],"products":[{"vendor":"wikimedia","product":"parsoid"}],"references":[{"url":"https://phabricator.wikimedia.org/T279451","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.mediawiki.org/wiki/Parsoid","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://security.gentoo.org/glsa/202107-40","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30458","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/wikimedia/parsoid/CVE-2021-30458.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5pqx-77vf-85rw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-30458","tags":["advisory"]},{"url":"https://github.com/wikimedia/mediawiki-services-parsoid","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-30458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-30458","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-30458","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2021-04-09T06:06:04Z","modified":"2024-08-03T22:32:41.119Z","updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2022-2633","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2021-04-09T06:06:04Z","modified":"2024-08-03T22:32:41Z","updated_at":"2026-11-03T03:24:41.906207Z"}],"ghsa":[{"id":"GHSA-5pqx-77vf-85rw","title":"Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2022-05-24T17:47:02Z","modified":"2024-06-07T22:12:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2021-30458","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2021-04-09T07:15:16.34Z","modified":"2026-06-17T03:50:16.96Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"CVE-2021-30458","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2021-04-09T07:15:16.34Z","modified":"2026-10-24T10:31:04.982059284Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-30458","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2021-04-09T07:15:16.34Z","modified":"2026-10-23T18:03:26.082613996Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-5pqx-77vf-85rw","title":"Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS)","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2022-05-24T17:47:02Z","modified":"2024-06-07T22:29:02.090533Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2021-30458","description":"An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a \u003cmeta\u003e tag, bypassing sanitization steps, and potentially allowing for XSS.","status":"published","published":"2021-04-09T07:15:00Z","modified":"2026-10-17T12:55:45.628325862Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"}]}}