TI-2021-17928 Aliases CVE-2021-41086 GHSA-qh7x-j4v8-qw5w

Clipboard-based XSS in jsuites

LOW 39CWE-79Published 2021-09-21 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.

Why it matters now

EPSS 0.00914 60th percentileScored 2026-11-08

Fix Fixed jsuites (jsuites): 4.9.11jsuites (npm): 4.9.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jsuites	jsuites	before 4.9.11	4.9.11	Patch available	CNA
—	jsuites (npm)	before 4.9.11	4.9.11	Patch available	GHSA-qh7x-j4v8-qw5w

jsuites Vendorjsuites Affected before 4.9.11 Fixed in 4.9.11 Patch available CNA
jsuites (npm) Vendor— Affected before 4.9.11 Fixed in 4.9.11 Patch available GHSA-qh7x-j4v8-qw5w

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jsuites:jsuites::::::::	before 4.9.11	Vulnerable	jsuites

cpe:2.3:a:jsuites:jsuites:*:*:*:*:*:*:*:* Versions before 4.9.11 Vulnerable ·jsuites

Remediation

Fix · CNA jsuites (jsuites) Fixed in 4.9.11
Fix · GHSA-qh7x-j4v8-qw5w jsuites (npm) Fixed in 4.9.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41086
2026-10-03 Alias added: GHSA-qh7x-j4v8-qw5w

References

Patch 2

Advisory 2

Other 2

TI-2022-09496 Cross-site scripting in jsuites CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences