CVE-2021-43785

    Dashboard / Vulnerabilities / CVE-2021-43785

    CVE-2021-43785

    Published: 26 Nov 2021Last Modified: 27 Aug 2026

    Summary:

    Details: @joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.

    References: https://github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq, https://github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16, https://github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ef8ac84e19ff7f76c955882f7dfe2acc794d1fdb

    Affected versions

    v4.6.1
    v4.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-43785 | CVE-DB