TI-2022-08646 Aliases CVE-2022-24833 GHSA-cqcc-mm6x-vmvw

Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin

HIGH 69CWE-79Published 2022-04-11 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01358 71st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed PrivateBin (PrivateBin): v1.4.0privatebin/privatebin (Packagist): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PrivateBin	PrivateBin	v0.21 to before v1.4.0	v1.4.0	Patch available	CNA
—	privatebin/privatebin (Packagist)	0.21 to before 1.4.0	1.4.0	Patch available	GHSA-cqcc-mm6x-vmvw

PrivateBin VendorPrivateBin Affected v0.21 to before v1.4.0 Fixed in v1.4.0 Patch available CNA
privatebin/privatebin (Packagist) Vendor— Affected 0.21 to before 1.4.0 Fixed in 1.4.0 Patch available GHSA-cqcc-mm6x-vmvw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:privatebin:privatebin::::::::	0.21 to before 1.4.0	Vulnerable	PrivateBin

cpe:2.3:a:privatebin:privatebin:*:*:*:*:*:*:*:* Versions 0.21 to before 1.4.0 Vulnerable ·PrivateBin

Remediation

Fix · CNA PrivateBin (PrivateBin) Fixed in v1.4.0
Fix · GHSA-cqcc-mm6x-vmvw privatebin/privatebin (Packagist) Fixed in 1.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24833
2026-10-03 Alias added: GHSA-cqcc-mm6x-vmvw

References

TI-2025-40057 PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users CVSS 3.1MEDIUM 5.4
TI-2020-04279 Persistent XSS vulnerability in filename of attached file in PrivateBin CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences