{"api_version":"1","generated_at":"2026-07-24T21:29:05+00:00","cve":"CVE-2021-39205","urls":{"html":"https://cve.report/CVE-2021-39205","api":"https://cve.report/api/cve/CVE-2021-39205.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-39205","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-39205"},"summary":{"title":"CVE-2021-39205","description":"Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2021-09-15 18:15:00","updated_at":"2022-09-10 02:45:00"},"problem_types":["CWE-79","CWE-1321"],"metrics":[],"references":[{"url":"https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg","name":"https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg","refsource":"CONFIRM","tags":[],"title":"DOM-based XSS/Content Spoofing via Prototype Pollution · Advisory · jitsi/jitsi-meet · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://hackerone.com/reports/1214493","name":"https://hackerone.com/reports/1214493","refsource":"MISC","tags":[],"title":"HackerOne","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/jitsi/jitsi-meet/pull/9320","name":"https://github.com/jitsi/jitsi-meet/pull/9320","refsource":"MISC","tags":[],"title":"fix: Escapes some keys when parsing input. by damencho · Pull Request #9320 · jitsi/jitsi-meet · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/jitsi/jitsi-meet/pull/9404","name":"https://github.com/jitsi/jitsi-meet/pull/9404","refsource":"MISC","tags":[],"title":"fix: Checks all parts while parsing config params. by damencho · Pull Request #9404 · jitsi/jitsi-meet · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39205","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39205","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"39205","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"8x8","cpe5":"jitsi_meet","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-39205","qid":"690194","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for couchdb (a7dd4c2d-77e4-46de-81a2-c453c317f9de)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2021-39205","STATE":"PUBLIC","TITLE":"DOM-based XSS/Content Spoofing via Prototype Pollution"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"jitsi-meet","version":{"version_data":[{"version_value":"< 2.0.6173"}]}}]},"vendor_name":"jitsi"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading."}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]},{"description":[{"lang":"eng","value":"CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}]},"references":{"reference_data":[{"name":"https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg","refsource":"CONFIRM","url":"https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"},{"name":"https://github.com/jitsi/jitsi-meet/pull/9320","refsource":"MISC","url":"https://github.com/jitsi/jitsi-meet/pull/9320"},{"name":"https://github.com/jitsi/jitsi-meet/pull/9404","refsource":"MISC","url":"https://github.com/jitsi/jitsi-meet/pull/9404"},{"name":"https://hackerone.com/reports/1214493","refsource":"MISC","url":"https://hackerone.com/reports/1214493"}]},"source":{"advisory":"GHSA-6582-8v9q-v3fg","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2021-09-15 18:15:00","lastModifiedDate":"2022-09-10 02:45:00","problem_types":["CWE-79","CWE-1321"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:8x8:jitsi_meet:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.6173","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"39205","Ordinal":"214846","Title":"CVE-2021-39205","CVE":"CVE-2021-39205","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"39205","Ordinal":"1","NoteData":"Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"39205","Ordinal":"2","NoteData":"2021-09-15","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"39205","Ordinal":"3","NoteData":"2021-09-15","Type":"Other","Title":"Modified"}]}}}