{"id":"CVE-2021-23414","aliases":["GHSA-pp7m-6j83-m7r6"],"url":"https://o3.security/vulnerability/CVE-2021-23414","summary":"Cross-site Scripting in video.js","details":"This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.","published":"2021-07-28T08:15:07.077Z","modified":"2026-07-08T05:57:08.049256185Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"video.js","fixedVersion":"7.14.3"}],"fix":{"url":"https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2","label":"videojs/video.js@b3acf66"},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/"},{"type":"FIX","url":"https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1533587"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-VIDEOJS-1533429"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:57:08.049256185Z"}}