GHSA-f2c5-997w-7f5c

Cross-site Scripting in peertube

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3780

Packages

Ecosystem	Package	Affected	Fixed in
npm	peertube	< 3.4.0	3.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3780 advisory
https://github.com/chocobozzz/peertube/commit/0ea2f79d45b301fcd660efc894469a99b2239bf6 web
https://github.com/chocobozzz/peertube package
https://huntr.dev/bounties/282807a8-4bf5-4fe2-af62-e05f945b3d65 web