CVE-2021-46888

Description

An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

Weakness classification

• nvd@nist.gov: CWE-79

Primary references

• cve@mitre.org — Exploit, Issue Tracking, Vendor Advisory
• cve@mitre.org — Exploit, Issue Tracking, Patch, Third Party Advisory
• cve@mitre.org — Release Notes
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory