{"id":"CVE-2021-32641","aliases":["GHSA-jr3j-whm4-9wwm"],"url":"https://o3.security/vulnerability/CVE-2021-32641","summary":"Reflected XSS when using flashMessages or languageDictionary","details":"### Overview\n\nVersions before and including `11.30.0` are vulnerable to reflected XSS.  An attacker can execute arbitrary code when the library's\n- `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage`.\n- `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`.\n\n### Am I affected?\nYou are affected by this vulnerability if you are using `auth0-lock` version `11.30.0` or lower and all of the following conditions apply:\n\n- You are utilizing `flashMessage` feature.\n- User input or data from URL parameters is incorporated into the `flashMessage`.\n\nAn example of a vulnerable snippet where query parameters are used to populate the `text` property of a `flashMessage`.\n```js\nvar params = new URLSearchParams(location.search);\nvar errorMessage = params.get('error__message');\nvar showParams = {};\n\nif (!!errorMessage === true) {\n  showParams.flashMessage = {\n    type: 'error',\n    text: 'We were unable to log you in. ' + errorMessage,\n  };\n}\n\nlock.show(showParams);\n```\n\nOR\n\n- You are utilizing `languageDictionary` feature.\n- User input or data from URL parameters is used in `languageDictionary` properties.\n\nAn example of a vulnerable snippet where query parameters are used to populate the `socialLoginInstructions` property of a `languageDictionary`.\n```js\nvar params = new URLSearchParams(location.search);\nvar instruction = params.get('instruction');\n\nvar options = {\n  languageDictionary: {\n    emailInputPlaceholder: \"something@youremail.com\",\n    title: \"title\",\n    socialLoginInstructions: instruction\n  },\n};\n\nvar lock = new Auth0LockPasswordless(\n    CLIENT_ID,\n    DOMAIN,\n    options\n);\n\nlock.show()\n```\n\n### How to fix that?\nUpgrade to version `11.30.1`.\n\n### Will this update impact my users?\nThe fix uses [DOMPurify](https://github.com/cure53/DOMPurify) to sanitise the `flashMessage` and `languageDictionary` inputs. If you are including inline JavaScript in these fields, like `script` tags or `onclick` attributes, these will be removed.","published":"2021-06-04T21:15:07.573Z","modified":"2026-07-09T00:37:56.171496Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"auth0-lock","fixedVersion":"11.30.1"}],"fix":{"url":"https://github.com/auth0/lock/commit/d139cf01c8234b07caf265e051f39d3eab08f7ed","label":"auth0/lock@d139cf0"},"references":[{"type":"ADVISORY","url":"https://github.com/auth0/lock/releases/tag/v11.30.1"},{"type":"FIX","url":"https://github.com/auth0/lock/commit/d139cf01c8234b07caf265e051f39d3eab08f7ed"},{"type":"EVIDENCE","url":"https://github.com/auth0/lock/security/advisories/GHSA-jr3j-whm4-9wwm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32641"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T00:37:56.171496Z"}}