Cross-site Scripting (XSS)

published 2021-09-21 5 y ago modified 2026-07-08 4 mo ago also GHSA-55r9-7mf8-m382 , EUVD-2021-1980

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits: 0; none known

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.

Patch / fix

fixed in 2 links 2

npm edge.js 5.3.2
n/a edge.js 5.3.2

github.com/edge-js/edge@fa2c7fd commit
snyk.io/vuln/SNYK-JS-EDGEJS-1579556 advisory

Exploit prediction

0.91% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

snyk.io https://snyk.io/vuln/SNYK-JS-EDGEJS-1579556 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	edge.js	<5.3.2	5.3.2

Affected products

n/a edge.js

Classification

Weakness

CWE-843 Access of Resource Using Incompatible Type
CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /edge-js/edge/commit/fa2c7fde86327aeae232752e89a6e37e2e469e21
web, patch, third-party-advisory
snyk.io /vuln/SNYK-JS-EDGEJS-1579556
web, exploit, patch, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-23443
advisory
github.com /edge-js/edge
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary