GHSA-g3fq-3v3g-mh32

    Dashboard / Vulnerabilities / GHSA-g3fq-3v3g-mh32

    GHSA-g3fq-3v3g-mh32

    Published: 16 Apr 2021Last Modified: 8 Jul 2026

    Summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs

    Details: ### Impact The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. _Note_: Nextcloud Server employs a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities. ### Patches The vulnerability has been patched in version 3.1.2. If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag. ### Workarounds Make sure no user-supplied input flows into toasts.

    References: https://github.com/nextcloud/nextcloud-dialogs/security/advisories/GHSA-g3fq-3v3g-mh32, https://nvd.nist.gov/vuln/detail/CVE-2021-29438, https://www.npmjs.com/package/@nextcloud/dialogs

    Affected packages

    Package

    Name: @nextcloud/dialogs

    Purl: pkg:npm/%40nextcloud/dialogs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -3.1.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-g3fq-3v3g-mh32 | CVE-DB