CVE-2021-3785

Description

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in edit dialog.

How to fix CVE-2021-3785

To remediate CVE-2021-3785, upgrade the affected package to a fixed version below.

• Packagist/yourls/yourls—upgrade to 1.8.2 or later

Is CVE-2021-3785 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.8.2

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-3785
• PATCHgithub.com/yourls/yourls
• WEBgithub.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff
• WEBhuntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638