Loading vulnerability…
Cross-site scripting in video.js track src attribute
CVE-2021-23414 is a cross-site scripting issue in the video.js package affecting versions before 7.14.3. The vulnerability arises because the src attribute of the HTML track tag is not safely handled, allowing an attacker to bypass HTML escaping. By supplying a crafted value in this attribute, arbitrary script execution can be triggered in the victim's browser within the context of the affected application that renders the malicious video.js content.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in client-side arbitrary JavaScript execution in the victim's browser. This can enable session theft, DOM manipulation, unauthorized actions in the context of the victim user, access to sensitive application data exposed to the browser, and broader compromise of the web application's trust boundary. In downstream products embedding vulnerable video.js, such as Festo LX Appliance versions prior to June 2023, the issue can be used to launch an XSS attack via malicious course content.
If you can’t patch tonight, do this now.
If immediate patching is not possible, prevent untrusted users from supplying or modifying track src values or any content that is rendered into video.js player markup. Sanitize and strictly validate media metadata and course content before rendering, enforce contextual output encoding, and deploy a restrictive Content Security Policy to reduce XSS impact. In appliance or ICS environments, additionally minimize Internet exposure, segment affected systems, and restrict remote access paths while updates are being applied.
Patch, then assume compromise.
Upgrade video.js to version 7.14.3 or later. For affected downstream products, apply the vendor-provided update; for example, Festo advises LX Appliance customers running versions prior to June 2023 to update through Festo Didactic services and review advisory FSA-202301. Validate that all bundled or transitive copies of video.js have been updated, not just direct dependencies.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.