Skip to content
Fencer Vulns
low 3.7

CVE-2021-43862 json

Self XSS on user input

published 2021-12-30 4 y ago modified 2026-07-08 4 mo ago also GHSA-x9r5-jxvq-4387 , EUVD-2022-0739

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible, but an attacker can use other techniques to hide the code the victim sees. If the application uses the `execHash` option and executes code from URL, the attacker can use this URL to execute their code. The scope is limited because the javascript attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible. This issue is fixed in version 2.31.1. As a workaround, the user can use formatting that wrap whole user input and its no op. The code for this workaround is available in the GitHub Security Advisory. The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way).

Patch / fix

  • npm jquery.terminal 2.31.1
  • jquery.terminal_project jquery.terminal 2.31.1

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/jcubic/jquery.terminal/security/advisories/GHSA-x9r5-jxvq-4387 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N
GitHub 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm jquery.terminal
<2.31.1
2.31.1

Affected products

  • jcubic jquery.terminal

Classification

Weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.