{"id":"CVE-2021-46888","aliases":["EUVD-2021-33538","GHSA-9fcq-h23h-rxhx","HSEC-2023-0008"],"status":"published","title":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability...","description":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00765,"percentile":0.55757,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-05-21T00:00:00Z","modified":"2026-10-20T10:55:17Z","fixes":[{"ecosystem":"Hackage","package":"hledger-web","fixed_in":["1.23"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hackage","package":"hledger-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24"},{"fixed":"1.23"}]}],"versions":["0.24","0.24.1","0.25","0.25.1","0.26","0.27","1.0","1.0.1","1.1","1.10","1.11","1.11.1","1.12","1.13","1.14","1.14.1","1.15","1.16","1.16.1","1.16.2","1.17","1.17.1","1.18","1.18.1","1.19","1.19.1","1.2","1.20","1.20.1","1.20.2","1.20.3","1.20.4","1.21","1.22","1.22.1","1.22.2","1.3","1.3.1","1.3.2","1.4","1.5","1.5.1","1.9","1.9.1","1.9.2"]}],"products":[{"vendor":"hledger","product":"hledger"}],"references":[{"url":"https://github.com/simonmichael/hledger/issues/1525","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/simonmichael/hledger/pull/1663","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/simonmichael/hledger/releases/tag/1.23","tags":["x_transferred","Release Notes","advisory"]},{"url":"https://www.youtube.com/watch?v=QnRO-VkfIic","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46888"},{"url":"https://github.com/advisories/GHSA-9fcq-h23h-rxhx"},{"url":"https://github.com/simonmichael/hledger/commit/ec51d28839b2910eea360b1b8c72904b51cf7821","tags":["introduced"]}],"sources":{"cve":[{"id":"CVE-2021-46888","description":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.","status":"published","published":"2023-05-21T00:00:00Z","modified":"2025-01-21T16:56:19.679Z","updated_at":"2026-11-02T14:33:03.320536Z"}],"euvd":[{"id":"EUVD-2021-33538","description":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.","status":"published","published":"2023-05-21T00:00:00Z","modified":"2025-01-21T16:56:19Z","updated_at":"2026-11-03T00:04:16.173755Z"}],"ghsa":[{"id":"GHSA-9fcq-h23h-rxhx","title":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability...","description":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.","status":"published","published":"2023-05-21T21:30:14Z","modified":"2024-04-04T04:15:48Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:22.389253Z"}],"nvd":[{"id":"CVE-2021-46888","description":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.","status":"published","published":"2023-05-21T20:15:09.24Z","modified":"2026-06-17T04:15:45.27Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"CVE-2021-46888","description":"An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.","status":"published","published":"2023-05-21T20:15:09.24Z","modified":"2026-10-20T10:55:17.855486589Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"HSEC-2023-0008","title":"Stored XSS in hledger-web","description":"# Stored XSS in *hledger-web*\n\nAn issue was discovered in *hledger-web* \u003c 1.23. A Stored Cross-Site\nScripting (XSS) vulnerability exists in `toBloodhoundJson` that\nallows an attacker to execute JavaScript by encoding user-controlled\nvalues in a payload with base64 and parsing them with the `atob`\nfunction.\n\n*hledger-web* forms sanitise obvious JavaScript, but not obfuscated\nJavaScript (see [OWASP Filter Evasion Cheat Sheet][cheatsheet]).\nThis means *hledger-web* instances, especially anonymously-writable\nones like `demo.hledger.org`, could be loaded with malicious\nJavaScript to be executed by subsequent visitors.\n\n[cheatsheet]: https://owasp.org/www-community/xss-filter-evasion-cheatsheet\n\nReported by Gaspard Baye and Hamidullah Muslih.  Fix by Arsen\nArsenović.\n","status":"published","published":"2025-11-14T14:45:34Z","modified":"2025-11-14T18:15:37.223382Z","updated_at":"2026-11-02T15:47:17.805107Z"}]}}