Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-s9bd-8czt-fbcg
Summary
File upload local preview can run embedded scripts after user interaction
### Impact

When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.

### Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.

### Workarounds

There are no known workarounds.
Aliases
0
alias GHSA-8796-gc9j-63rv
Fixed_packages
0
url pkg:npm/matrix-react-sdk@3.21.0
purl pkg:npm/matrix-react-sdk@3.21.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1g1f-1x88-tbg5
1
vulnerability VCID-3s7z-6bqr-rqd1
2
vulnerability VCID-e42f-h16f-gkbf
3
vulnerability VCID-k3ft-j7d1-nkh7
4
vulnerability VCID-ybpz-t956-k7fb
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/matrix-react-sdk@3.21.0
Affected_packages
References
0
reference_url https://github.com/matrix-org/matrix-react-sdk
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/matrix-org/matrix-react-sdk
1
reference_url https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-8796-gc9j-63rv
2
reference_url https://github.com/advisories/GHSA-8796-gc9j-63rv
reference_id GHSA-8796-gc9j-63rv
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8796-gc9j-63rv
Weaknesses
0
cwe_id 74
name Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Exploits
Severity_range_score4.0 - 6.9
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-s9bd-8czt-fbcg