CVE-2021-39178
XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.
Next.js es un framework de React. Las versiones de Next.js entre 10.0.0 y 11.0.0 contienen una vulnerabilidad de tipo cross-site scripting. Para que una instancia este afectada por la vulnerabilidad, el archivo "next.config.js" debe tener asignado el array "images.domains" y el host de imágenes asignado en "images.domains" debe permitir el SVG proporcionado por el usuario. Si el archivo "next.config.js" tiene asignado "images.loader" a algo distinto de lo predeterminado o la instancia está desplegada en Vercel, la instancia no está afectada por la vulnerabilidad. La vulnerabilidad está parcheada en versión 11.1.1 de Next.js
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-08-16 CVE Reserved
- 2021-08-30 CVE Published
- 2024-05-15 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/vercel/next.js/releases/tag/v11.1.1 | 2021-09-08 | |
https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m | 2021-09-08 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Vercel Search vendor "Vercel" | Next.js Search vendor "Vercel" for product "Next.js" | >= 10.0.0 < 11.1.1 Search vendor "Vercel" for product "Next.js" and version " >= 10.0.0 < 11.1.1" | node.js |
Affected
|