{"id":"CVE-2021-3780","aliases":["EUVD-2021-2045","GHSA-f2c5-997w-7f5c"],"status":"published","title":"Cross-site Scripting (XSS) - Stored in chocobozzz/peertube","description":"peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","severity":{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00899,"percentile":0.59923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-09-15T11:15:11Z","modified":"2026-10-20T10:53:54Z","fixes":[{"ecosystem":"npm","package":"peertube","fixed_in":["3.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"peertube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}]},{"source":"osv","ecosystem":"npm","package":"peertube","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}]}],"products":[{"vendor":"chocobozzz","product":"chocobozzz/peertube"},{"vendor":"framasoft","product":"peertube"}],"references":[{"url":"https://huntr.dev/bounties/282807a8-4bf5-4fe2-af62-e05f945b3d65","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/chocobozzz/peertube/commit/0ea2f79d45b301fcd660efc894469a99b2239bf6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3780","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f2c5-997w-7f5c"},{"url":"https://github.com/chocobozzz/peertube","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-3780","title":"Cross-site Scripting (XSS) - Stored in chocobozzz/peertube","description":"peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","status":"published","published":"2021-09-15T11:15:11Z","modified":"2024-08-03T17:09:08.86Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-2045","description":"peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","status":"published","published":"2021-09-15T11:15:11Z","modified":"2024-08-03T17:09:08Z","cvss":[{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T03:25:11.953192Z"}],"ghsa":[{"id":"GHSA-f2c5-997w-7f5c","title":"Cross-site Scripting in peertube","description":"peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers.","status":"published","published":"2021-09-20T20:42:41Z","modified":"2023-02-01T05:06:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:38.281533Z"}],"nvd":[{"id":"CVE-2021-3780","description":"peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","status":"published","published":"2021-09-15T12:15:16.133Z","modified":"2026-06-17T04:05:44.94Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":7.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:58.502206Z"}],"osv":[{"id":"CVE-2021-3780","description":"peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","status":"published","published":"2021-09-15T12:15:16.133Z","modified":"2026-10-20T10:53:54.87066402Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-f2c5-997w-7f5c","title":"Cross-site Scripting in peertube","description":"peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers.","status":"published","published":"2021-09-20T20:42:41Z","modified":"2023-11-08T04:06:24.324693Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}