{"id":"CVE-2021-23562","aliases":["GHSA-rp2c-jrgp-cvr8"],"url":"https://o3.security/vulnerability/CVE-2021-23562","summary":"Code injection in plupload","details":"This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.","published":"2021-12-03T20:15:07.463Z","modified":"2026-07-09T06:35:03.091455Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"plupload","fixedVersion":"2.3.9"}],"fix":{"url":"https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fb","label":"moxiecode/plupload@d12175d"},"references":[{"type":"WEB","url":"https://github.com/moxiecode/plupload/blob/master/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226"},{"type":"FIX","url":"https://github.com/moxiecode/plupload/commit/d12175d4b5fa799b994ee1bb17bfbeec55b386fb"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-2306665"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2306663"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMOXIECODE-2306664"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JS-PLUPLOAD-1583909"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T06:35:03.091455Z"}}