Read the docs
TI-2021-12351 Aliases CVE-2021-32683

XSS through createObjectURL

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab (right click -> open in new tab, or copy the URL and paste it in the URL bar), an the image payload is executed on the domain hosting the app (app.wire.com). In particular, if an image contains malicious code in addition to the actual picture, this code is executed on app.wire.com. This allows the attacker to fully control the user account. The vulnerability was patched in version 2021-06-01-production.0. As a workaround, users should not try to open image URLs.

Why it matters now

EPSS 0.00826 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed wire-webapp (wireapp): 2021-06-01-production.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
wireappwire-webappbefore 2021-06-01-production.02021-06-01-production.0Patch availableCNA
  • wire-webapp Vendorwireapp Affected before 2021-06-01-production.0 Fixed in 2021-06-01-production.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wire:wire-webapp:*:*:*:*:*:*:*:*before 2021-06-01Vulnerablewireapp
  • cpe:2.3:a:wire:wire-webapp:*:*:*:*:*:*:*:* Versions before 2021-06-01 Vulnerable ·wireapp

Remediation

  • Fix · CNA wire-webapp (wireapp) Fixed in 2021-06-01-production.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32683

References

Exploit 1

Patch 1

  • TI-2022-08612 Cross Site Scripting in Wire Webapp CVSS 3.1CRITICAL 9.6
  • TI-2022-11712 Cross Site Scripting in Wire Messages CVSS 3.1CRITICAL 9.6
  • TI-2021-04498 Entering code in App Lock modal sends input to conversation CVSS 3.1HIGH 7.1
  • TI-2022-18754 wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering CVSS 3.1MEDIUM 5.3
  • TI-2025-30437 wire-webapp has no database deletion on client logout CVSS 3.1MEDIUM 6.0
  • TI-2022-07658 Expired Ephemeral Messages not reliably removed in wire-webapp CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences