CVE-2021-23414

PoC ×3—

CVSS 3.1

6.1 medium

EPSS

3%p84

Published

Jul 28, 2021 (Jul 28, 2021)

Modified

Jun 17, 2026

Description

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

Vendors: videojs fedoraproject
Products: video.js, fedora
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news1 stories

Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries

The Hacker NewsAug 2, 11:07 UTC · Aug 2, 2022Vulnerability CVE-2021-33056 CVE-2021-23414 CVE-2021-37352+5 CVEs1

60