{"id":"CVE-2021-32850","aliases":["DEBIAN-CVE-2021-32850","EUVD-2023-0692","GHSA-crh5-vv2v-c82q","MGASA-2024-0052","UBUNTU-CVE-2021-32850"],"status":"published","title":"jQuery MiniColors vulnerable to Cross-site Scripting","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00802,"percentile":0.57079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-02-20T00:00:00Z","modified":"2026-10-23T18:03:14Z","fixes":[{"ecosystem":"npm","package":"@claviska/jquery-minicolors","fixed_in":["2.3.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jquery-minicolors","fixed_in":["2.3.5+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jquery-minicolors","fixed_in":["2.3.5+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jquery-minicolors","fixed_in":["2.3.5+dfsg-4"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"sympa","fixed_in":["6.2.72-4.mga9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@claviska/jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5+dfsg-4"}]}]},{"source":"osv","ecosystem":"npm","package":"@claviska/jquery-minicolors","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.6"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"sympa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.72-4.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.6+dfsg-2","2.2.6+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.6+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.6+dfsg-4","2.3.5+dfsg-1","2.3.5+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.5+dfsg-4","2.3.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.6+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jquery-minicolors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.6+dfsg-1","2.3.6+dfsg-1build1"]}],"products":[{"vendor":"jquery-minicolors_project","product":"jquery-minicolors"},{"vendor":"npm","product":"@claviska/jquery-minicolors"}],"references":[{"url":"https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/claviska/jquery-minicolors/releases/tag/2.3.6","tags":["x_transferred","Release Notes","advisory","web","report"]},{"url":"https://securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin/","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32850","tags":["advisory"]},{"url":"https://codepen.io/webbiesdk/pen/oNBQNNV","tags":["web"]},{"url":"https://vuldb.com/?ctiid.215306","tags":["web"]},{"url":"https://vuldb.com/?id.215306","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO/"},{"url":"https://github.com/advisories/GHSA-crh5-vv2v-c82q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32850","tags":["advisory"]},{"url":"https://github.com/claviska/jquery-minicolors","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO","tags":["web"]},{"url":"https://securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0052.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32896","tags":["report"]},{"url":"https://github.com/sympa-community/sympa/releases/tag/6.2.72","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32850","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2021-32850","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-32850","title":"jQuery MiniColors vulnerable to Cross-site Scripting","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2025-03-10T21:09:21.659Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2023-0692","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2025-03-10T21:09:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"ghsa":[{"id":"GHSA-crh5-vv2v-c82q","title":"@claviska/jquery-minicolors vulnerable to Cross-site Scripting","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-21T00:30:20Z","modified":"2023-06-12T16:44:22Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2021-32850","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-20T22:15:10.97Z","modified":"2026-06-17T03:53:45.47Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:07.323379Z"}],"osv":[{"id":"CVE-2021-32850","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-20T22:15:10.97Z","modified":"2026-10-20T10:53:46.783640701Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32850","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-20T22:15:10.97Z","modified":"2026-10-23T18:03:14.469220232Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-crh5-vv2v-c82q","title":"@claviska/jquery-minicolors vulnerable to Cross-site Scripting","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-21T00:30:20Z","modified":"2023-11-08T04:06:02.29475Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2021-32850","description":"jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.","status":"published","published":"2023-02-20T22:15:00Z","modified":"2026-10-17T12:55:46.735883817Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"MGASA-2024-0052","title":"Updated sympa packages fix security vulnerabilities","description":"Sympa 6.2.72 fixes many bugs, including the security one related in\nCVE-2021-32850\nIt is required to manually run sympa upgrade after get this update\n","status":"published","published":"2024-02-29T17:41:10Z","modified":"2026-05-30T05:15:04.44531809Z","updated_at":"2026-11-02T15:49:42.684501Z"}]}}