CVE-2021-25964

Advisory

Calibreweb versions 0.6.0 to 0.6.12 are vulnerable to Stored XSS in "Metadata". An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25964
• https://github.com/janeczku/calibre-web/commit/32e27712f0f71fdec646add20cd78b4ce75acfce
• https://github.com/janeczku/calibre-web/releases/tag/0.6.13#:~:text=Security%20fix%3A%20JavaScript%20payload%20can%20no%20longer%20be%20incjected%20in%20the%20description%20field
• https://nvd.nist.gov/vuln/detail/CVE-2021-25964
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25964