CVE-2021-39169: XSS vulnerability using dialog

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-27 · updated 2026-06-17
Weakness: CWE-79

Description

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting (XSS). XSS could compromise the API request token. This issue has been fixed in version 12.51.0. There are no known workarounds aside from upgrading.

Affected products

misskey-dev misskey: before 12.51.0 — fixed in 12.51.0

How to fix

Upgrade to a fixed version: misskey-dev misskey 12.51.0. Check the vendor advisory for mitigations.

References

https://github.com/misskey-dev/misskey/commit/ec203f7f795766f76b55fecc9248168c1cdf6c99
https://github.com/misskey-dev/misskey/security/advisories/GHSA-pmmv-jwqh-f5ww
https://github.com/misskey-dev/misskey/commit/ec203f7f795766f76b55fecc9248168c1cdf6c99
https://github.com/misskey-dev/misskey/security/advisories/GHSA-pmmv-jwqh-f5ww

Get alerted when CVE-2021-39169 or the next vulnerability affects your stack