Medium
Security advisory
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-20186
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:20 UTC · Revision 1
Source evidence
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.
osv:CVE-2021-20186
Complete source record
{
"id": "c278a67b4524764ae9a28b221eb62970e38028173194dc3d3df7d05fcabf3508",
"url": "https://osv.dev/vulnerability/CVE-2021-20186",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-20186",
"summary": "It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.",
"evidence": "osv:CVE-2021-20186",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-20186",
"aliases": [
"BIT-moodle-2021-20186",
"CVE-2021-20186",
"GHSA-h8m4-h385-qhqv"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/moodle/moodle",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "bbf242efb086307a0af9367d6caea08649b261d1"
},
{
"introduced": "f968cd44e8ee5d54b1bc56823040ff770dbf18af"
},
{
"fixed": "323c12674aa74d327ded9f5e44458cd5d1aea174"
},
{
"introduced": "500c131eb49771e36f68d151dfa37fef5a9bc2df"
},
{
"fixed": "de301d4237c42ddd0d4ae7395e663b8457943727"
},
{
"introduced": "ec58cefefb2722f61f77c9a2b6a12d40a8c078a0"
},
{
"fixed": "00821c744c3f102e706500f9815e0fa5e6b8fb25"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.5.16"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.8.0"
},
{
"fixed": "3.8.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.9.0"
},
{
"fixed": "3.9.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.10.0"
},
{
"fixed": "3.10.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.9.3",
"v3.5.15",
"v3.8.6",
"v3.10.0",
"v3.9.2",
"v3.8.5",
"v3.5.14",
"v3.5.13",
"v3.8.4",
"v3.9.1",
"v3.9.0",
"v3.8.3",
"v3.5.12",
"v3.8.2",
"v3.5.11",
"v3.5.10",
"v3.8.1",
"v3.8.0",
"v3.5.9",
"v3.5.8",
"v3.5.7",
"v3.5.6",
"v3.5.5",
"v3.5.4",
"v3.5.3",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.5.0-rc1",
"v3.5.0-beta",
"v3.4.0",
"v3.4.0-rc2",
"v3.4.0-rc3",
"v3.4.0-rc1",
"v3.4.0-beta",
"v3.3.0",
"v3.3.0-rc3",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.3.0-beta",
"v3.2.0-rc2",
"v3.2.0",
"v3.2.0-rc4",
"v3.2.0-beta",
"v3.2.0-rc5",
"v3.2.0-rc3",
"v3.2.0-rc1",
"v3.1.0-beta",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v3.0.0-rc3",
"v3.0.0",
"v3.0.0-rc4",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-beta",
"v2.9.0",
"v2.9.0-rc2",
"v2.9.0-rc1",
"v2.9.0-beta",
"v2.8.0",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-beta",
"v2.7.0",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.7.0-beta",
"v2.6.0",
"v2.6.0-rc1",
"v2.6.0-beta",
"v2.5.0",
"v2.5.0-rc1",
"v2.5.0-beta",
"v2.4.0-beta",
"v2.4.0-rc1",
"v2.4.0",
"v2.3.0",
"v2.3.0-rc1",
"v2.3.0-beta",
"v2.2.0",
"v2.2.0-rc1",
"v2.2.0-beta",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc2",
"v2.0.0-rc1",
"v1.3.0",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-20186.json"
}
}
],
"modified": "2026-10-24T10:30:51.907046519Z",
"provider": "osv",
"references": [
"https://moodle.org/mod/forum/discuss.php?d=417170"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-20186",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437580,
"published_at": "2021-01-28T19:15:13.3+00:00"
}