TI-2021-06136 Aliases CVE-2021-23445 GHSA-h73q-5wmj-q8pj

Cross-site scripting (XSS) in datatables.net

MEDIUM 60CWE-79Published 2021-09-27 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 4 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01975 80th percentileScored 2026-11-07

Fix Partial datatables.net: 1.11.3datatables.net (npm): 1.11.3Red Hat: 4 advisoriesRed Hat: 4 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	datatables.net	before 1.11.3	1.11.3	Patch available	CNA
—	datatables.net (npm)	before 1.11.3	1.11.3	Patch available	GHSA-h73q-5wmj-q8pj

datatables.net Vendor— Affected before 1.11.3 Fixed in 1.11.3 Patch available CNA
datatables.net (npm) Vendor— Affected before 1.11.3 Fixed in 1.11.3 Patch available GHSA-h73q-5wmj-q8pj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:datatables:datatables.net::::::node.js::*	before 1.11.3	Vulnerable	Datatables

cpe:2.3:a:datatables:datatables.net:*:*:*:*:*:node.js:*:* Versions before 1.11.3 Vulnerable ·Datatables

Remediation

Fix · CNA datatables.net Fixed in 1.11.3
Fix · GHSA-h73q-5wmj-q8pj datatables.net (npm) Fixed in 1.11.3 Advisory →

Red Hat 4 advisories

RHSA-2024:3563 Released 2024-06-03 · Red Hat rating Important
Red Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss Enterprise Application Platform org.apache.cxf.cxf-core-3.5.8.redhat-00001.jar, org.jboss.hal.hal-console-3.3.22.Final-redhat-00001-resources.jar, org.wildfly.security.wildfly-elytron-1.15.23.Final-redhat-00001.jar
RHSA-2024:3560 Released 2024-06-03 · Red Hat rating Important
Red Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-cxf-3.5.8-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el8eap +47
RHSA-2024:3561 Released 2024-06-03 · Red Hat rating Important
Red Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-cxf-3.5.8-1.redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el9eap, eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el9eap +47

Show 1 more Red Hat advisories

RHSA-2024:3559 Released 2024-06-03 · Red Hat rating Important
Red Hat JBoss Enterprise Application Platform 7.4.17 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-cxf-3.5.8-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.8-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.8-1.redhat_00001.1.el7eap +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Decision Manager 7	Affected	No fix planned: Will not fix
Red Hat Discovery 1	Affected	No fix planned: Will not fix
Red Hat Fuse 7	Affected	No fix planned: Will not fix
Red Hat JBoss Data Grid 7	Affected	No fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet
Red Hat OpenShift Container Platform 3.11	Affected	No fix planned: Out of support scope
Red Hat Process Automation 7	Affected	No fix planned: Will not fix
Red Hat Virtualization 4	Affected	No fix planned: Will not fix
Red Hat JBoss EAP 7.4 for RHEL 7 Server	Fixed	RHSA-2024:3559
Red Hat JBoss EAP 7.4 for RHEL 8	Fixed	RHSA-2024:3560
Red Hat JBoss EAP 7.4 for RHEL 9	Fixed	RHSA-2024:3561
Red Hat JBoss Enterprise Application Platform	Fixed	RHSA-2024:3563

Not affected: 5 products

Red Hat Enterprise Linux 8
Red Hat JBoss EAP 7.4 for RHEL 7 Server
Red Hat JBoss Enterprise Application Platform
Red Hat JBoss Enterprise Application Platform 8
Red Hat Satellite 6

Timeline

2026-10-02 Threatist record created from CVE-2021-23445
2026-10-03 Alias added: GHSA-h73q-5wmj-q8pj

References

Patch 1

https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b

Advisory 2

Other 5

TI-2020-17273 Prototype pollution in datatables.net CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences