GHSA-vqr3-vrrg-f3jh

ghsaUSosv

NodeBB Cross-site scripting (XSS) vulnerability

view advisory published 2025-01-24Licence: CC-BY-4.0

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-57041US	—	39.3% (99th)	—	2025-01-24
A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

references

External citations — patches, advisories, analysis.

https://github.com/NodeBB/NodeBBPACKAGE
https://github.com/NodeBB/NodeBB/commit/4e69bff72fd04779064d37e46a43080e6c328adfWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-57041ADVISORY
https://www.tonysec.com/posts/cve-2024-57041WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan