Security advisory

{
  "id": "f0412a567ad7b915a43d155961f0978ae2df9cab7a417c8d21a66a843f2b51ce",
  "url": "https://osv.dev/vulnerability/CVE-2021-21283",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-21283",
    "summary": "Flarum is an open source discussion platform for websites. The \"Flarum Sticky\" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where",
    "evidence": "osv:CVE-2021-21283",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2021-21283",
      "aliases": [
        "CVE-2021-21283",
        "GHSA-h3gg-7wx2-cq3h"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/flarum/sticky",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "7ebd30462bd405c4c0570b93a6d48710e6c3db19"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "fixed": "7ebd30462bd405c4c0570b93a6d48710e6c3db19"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.1.0-beta.15",
            "v0.1.0-beta.14",
            "v0.1.0-beta.13",
            "v0.1.0-beta.12",
            "v0.1.0-beta.9",
            "v0.1.0-beta.8",
            "v0.1.0-beta.7",
            "v0.1.0-beta.6",
            "v0.1.0-beta.5",
            "v0.1.0-beta.3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21283.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:28.844005862Z",
      "provider": "osv",
      "references": [
        "https://discuss.flarum.org/d/26042-security-update-to-flarum-sticky-010-beta151%29",
        "https://github.com/flarum/sticky/security/advisories/GHSA-h3gg-7wx2-cq3h",
        "https://github.com/flarum/sticky/commit/7ebd30462bd405c4c0570b93a6d48710e6c3db19",
        "https://github.com/flarum/sticky/pull/24"
      ],
      "provider_metadata": {
        "unresolved_ranges": [
          {
            "cpes": [
              "cpe:2.3:a:flarum:sticky:0.1.0:beta14:*:*:*:*:*:*",
              "cpe:2.3:a:flarum:sticky:0.1.0:beta15:*:*:*:*:*:*"
            ],
            "vendor_product": "flarum:sticky",
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0.1.0-beta14"
                  },
                  {
                    "last_affected": "0.1.0-beta14"
                  },
                  {
                    "introduced": "0.1.0-beta15"
                  },
                  {
                    "last_affected": "0.1.0-beta15"
                  }
                ],
                "source": "CPE_STRING"
              }
            ]
          }
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2021-21283",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385434,
  "published_at": "2021-01-26T21:15:12.767+00:00"
}