{"id":"CVE-2021-37860","aliases":["GHSA-hv5f-73mr-7vvj","GO-2022-0604"],"url":"https://o3.security/vulnerability/CVE-2021-37860","summary":"Cross-site Scripting in Mattermost","details":"Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.","published":"2021-09-22T17:15:11.647Z","modified":"2026-07-09T05:44:40.768663Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server/v5","fixedVersion":"5.39.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://mattermost.com/security-updates/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T05:44:40.768663Z"}}