TI-2021-16590 Aliases CVE-2021-39205

DOM-based XSS/Content Spoofing via Prototype Pollution

LOW 33CWE-1321Published 2021-09-15 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

Why it matters now

EPSS 0.01226 69th percentileScored 2026-11-07

Fix Fixed jitsi-meet (jitsi): 2.0.6173

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jitsi	jitsi-meet	before 2.0.6173	2.0.6173	Patch available	CNA

jitsi-meet Vendorjitsi Affected before 2.0.6173 Fixed in 2.0.6173 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:8x8:jitsi_meet::::::::	before 2.0.6173	Vulnerable	8x8

cpe:2.3:a:8x8:jitsi_meet:*:*:*:*:*:*:*:* Versions before 2.0.6173 Vulnerable ·8x8

Remediation

Fix · CNA jitsi-meet (jitsi) Fixed in 2.0.6173

Timeline

2026-10-02 Threatist record created from CVE-2021-39205

References

Patch 2

Advisory 1

https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg

Other 1

https://hackerone.com/reports/1214493

TI-2021-08445 Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the… CVSS 3.1MEDIUM 6.1
TI-2022-21330 OS command injection in https://github.com/jitsi CVSS 3.1CRITICAL 9.8
TI-2020-09546 The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default… CVSS 3.1CRITICAL 9.8
TI-2021-16600 Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms CVSS 3.1HIGH 7.5
TI-2020-15286 jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron… CVSS 3.1HIGH 7.5
TI-2026-62290 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture CVSS 4.0HIGH 7.1

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences