Cross-site scripting (XSS) in video.js
Priority LOW 34CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Why it matters now
EPSS 0.02549 85th percentileScored 2026-11-07
Fix Fixed video.js: 7.14.3video.js (npm): 7.14.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | video.js | before 7.14.3 | 7.14.3 | Patch available | CNA |
| — | video.js (npm) | before 7.14.3 | 7.14.3 | Patch available | GHSA-pp7m-6j83-m7r6 |
- video.js Vendor— Affected before 7.14.3 Fixed in 7.14.3 Patch available CNA
- video.js (npm) Vendor— Affected before 7.14.3 Fixed in 7.14.3 Patch available GHSA-pp7m-6j83-m7r6
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:videojs:video.js:*:*:*:*:*:node.js:*:* | before 7.14.3 | Vulnerable | Videojs |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:videojs:video.js:*:*:*:*:*:node.js:*:* Versions before 7.14.3 Vulnerable ·Videojs
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA video.js Fixed in 7.14.3
- Fix · GHSA-pp7m-6j83-m7r6 video.js (npm) Fixed in 7.14.3 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23414
- 2026-10-03 Alias added: GHSA-pp7m-6j83-m7r6
References
Advisory 4
Other 4
- https://github.com/videojs/video.js
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB
Sources
- CVE-2021-23414 · CVE Program
- CVE-2021-23414 · NVD
- FIRST EPSS
- GHSA-pp7m-6j83-m7r6 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23414 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences