CVE-2021-43635

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-04 · updated 2026-06-17
Weakness: CWE-79

Description

A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.

Affected products

Codexnotes Codex: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: Codexnotes Codex 1.4.0. Check the vendor advisory for mitigations.

References

https://github.com/jcv8000/Codex
https://github.com/jcv8000/Codex/issues/8
https://github.com/jcv8000/Codex/releases/tag/v1.4.1
https://github.com/jcv8000/Codex
https://github.com/jcv8000/Codex/issues/8
https://github.com/jcv8000/Codex/releases/tag/v1.4.1

Get alerted when CVE-2021-43635 or the next vulnerability affects your stack