TI-2021-19594 Aliases CVE-2021-43787 GHSA-wx69-rvg3-x7fc

XSS via prototype pollution

MEDIUM 42CWE-1321Published 2021-11-29 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

Why it matters now

EPSS 0.01317 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed NodeBB (NodeBB): 1.18.5nodebb (npm): 1.18.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NodeBB	NodeBB	1.15.5 to before 1.18.5	1.18.5	Patch available	CNA
—	nodebb (npm)	1.15.0 to before 1.18.5	1.18.5	Patch available	GHSA-wx69-rvg3-x7fc

NodeBB VendorNodeBB Affected 1.15.5 to before 1.18.5 Fixed in 1.18.5 Patch available CNA
nodebb (npm) Vendor— Affected 1.15.0 to before 1.18.5 Fixed in 1.18.5 Patch available GHSA-wx69-rvg3-x7fc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nodebb:nodebb::::::::	1.15.5 – 1.18.4	Vulnerable	NodeBB

cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* Versions 1.15.5 – 1.18.4 Vulnerable ·NodeBB

Remediation

Fix · CNA NodeBB (NodeBB) Fixed in 1.18.5
Fix · GHSA-wx69-rvg3-x7fc nodebb (npm) Fixed in 1.18.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43787
2026-10-03 Alias added: GHSA-wx69-rvg3-x7fc

References

Exploit 1

https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-43787

Other 2

TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
TI-2022-16499 Account takeover via SSO plugins in NodeBB CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences