Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-21259

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Security-Policy` header. Note that this will break some embedded content.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-21259
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:31 UTC · Revision 1

Source evidence

CVE-2021-21259

core-osv · Original source

Published 22 Jan 2021, 17:15 UTC

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Security-Policy` header. Note that this will break some embedded content.

osv:CVE-2021-21259
Complete source record
{
  "id": "c9a49dc1ec74e74699d4058ea700806001575d22658c0099fdc0e45129e8ee2f",
  "url": "https://osv.dev/vulnerability/CVE-2021-21259",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-21259",
    "summary": "HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Security-Policy` header. Note that this will break some embedded content.",
    "evidence": "osv:CVE-2021-21259",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2021-21259",
      "aliases": [
        "CVE-2021-21259",
        "GHSA-44w9-vm8p-3cxw"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hedgedoc/hedgedoc",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "d0547a033758df86caa338a94af8e66329281720"
                },
                {
                  "fixed": "35b0d39a12aa35f27fba8c1f50b1886706e7efef"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.7.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "35b0d39a12aa35f27fba8c1f50b1886706e7efef"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d0547a033758df86caa338a94af8e66329281720"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "1.7.2"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1.7.1",
            "1.7.0",
            "1.7.0-rc2",
            "1.7.0-rc1",
            "1.6.0",
            "1.5.0",
            "1.4.0",
            "1.3.2",
            "1.3.1",
            "1.3.0",
            "1.2.1",
            "1.2.0",
            "1.1.1-ce",
            "1.1.0-ce",
            "1.0.1-ce",
            "1.0.0-ce",
            "0.5.0",
            "0.4.6",
            "0.4.5",
            "0.4.4",
            "0.4.3",
            "0.4.2",
            "0.4.1",
            "0.4.0",
            "v0.3.4",
            "v0.3.3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21259.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:27.909979325Z",
      "provider": "osv",
      "references": [
        "https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2",
        "https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw",
        "https://github.com/hackmdio/codimd/issues/1648",
        "https://github.com/hedgedoc/hedgedoc/commit/35b0d39a12aa35f27fba8c1f50b1886706e7efef"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-21259",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385390,
  "published_at": "2021-01-22T17:15:12.867+00:00"
}