What’s Vulnerable › Vulnerabilities

CVE-2021-41132: Inconsistent input sanitisation leads to XSS vectors

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-14 · updated 2026-06-17
• Weakness: CWE-116

Description

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

Affected products

• Openmicroscopy Omero-Figure: before 4.4.1 — fixed in 4.4.1
• Openmicroscopy Omero-Web: before 5.11.0 — fixed in 5.11.0

How to fix

Upgrade to a fixed version: Openmicroscopy Omero-Figure 4.4.1; Openmicroscopy Omero-Web 5.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424
• https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf
• https://www.openmicroscopy.org/security/advisories/2021-SV3/
• https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424
• https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvf
• https://www.openmicroscopy.org/security/advisories/2021-SV3/

Get alerted when CVE-2021-41132 or the next vulnerability affects your stack