What’s Vulnerable › Vulnerabilities

CVE-2021-3427

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-26 · updated 2026-06-17
• Weakness: CWE-79

Description

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.

Affected products

• Dev Deluge: before 2.1.0 — fixed in 2.1.0

How to fix

Upgrade to a fixed version: Dev Deluge 2.1.0. Check the vendor advisory for mitigations.

References

• https://dev.deluge-torrent.org/ticket/3459
• https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
• https://security.gentoo.org/glsa/202210-07
• https://dev.deluge-torrent.org/ticket/3459
• https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
• https://security.gentoo.org/glsa/202210-07

Get alerted when CVE-2021-3427 or the next vulnerability affects your stack