Security advisory
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions 10.0.7, 10.1.4, 11.1.2, 11.2.0 or 12.0.0. As a workaround, use a browser that has support for Content-Security-Policy.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-39222
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:49 UTC · Revision 1
Source evidence
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions 10.0.7, 10.1.4, 11.1.2, 11.2.0 or 12.0.0. As a workaround, use a browser that has support for Content-Security-Policy.
osv:CVE-2021-39222
Complete source record
{
"id": "722b6183026b3b7811b4b1a6e90425e35a80fef92291131d420396604a3ffde2",
"url": "https://osv.dev/vulnerability/CVE-2021-39222",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-39222",
"summary": "Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions 10.0.7, 10.1.4, 11.1.2, 11.2.0 or 12.0.0. As a workaround, use a browser that has support for Content-Security-Policy.",
"evidence": "osv:CVE-2021-39222",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-39222",
"aliases": [
"CVE-2021-39222",
"GHSA-xhxq-f4vg-jw5g"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nextcloud/spreed",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "dae087773399f4b704ba4b9f22f74e0c12ac96f4"
},
{
"introduced": "a7fc0ed75ed8970846df758bf5c04750432e50ad"
},
{
"fixed": "9a5635719622fd7dfa5a98b0d0ce92519ac2ce04"
},
{
"introduced": "ecdbfcb42460e754b26933575576369643ee8661"
},
{
"fixed": "bc0f9dc685befbf77d1baee7670044d16875b783"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "10.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.1.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v10.1.3",
"v11.1.1",
"v10.0.6",
"v10.1.2",
"v11.0.0",
"v10.1.1",
"v10.0.5",
"v10.1.0",
"v10.0.4",
"v10.0.3",
"v10.0.2",
"v10.0.1",
"v10.0.0",
"v10.0.0-rc.2",
"v10.0.0-rc.1",
"v10.0.0-beta.2",
"v10.0.0-beta.1",
"v9.0.0-beta.1",
"v8.0.0",
"v8.0.0-alpha.6",
"v8.0.0-alpha.5",
"v8.0.0-alpha.4",
"v8.0.0-alpha.3",
"v8.0.0-alpha.2",
"v8.0.0-alpha.1",
"v7.0.0-beta.1",
"v6.0.0-rc.2",
"v6.0.0-rc.1",
"v5.99.10",
"v4.99.5",
"v4.0.0",
"v3.99.12",
"v3.99.11",
"v3.99.10",
"v3.99.8",
"v3.0.1",
"v3.0.0",
"v2.9.1",
"v2.9.0",
"v2.0.0",
"v1.2",
"v1.1.2",
"v1.0.22",
"v1.0.21"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39222.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/nextcloud/talk-android",
"type": "GIT",
"events": [
{
"introduced": "f1df514ff0b6000a640c9f0dee70773f79ad7d7f"
},
{
"fixed": "2f661b8076e79c9df8941cbadce59750cd7dfb0f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.1.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39222.json"
}
}
],
"modified": "2026-10-24T10:50:25.216694341Z",
"provider": "osv",
"references": [
"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xhxq-f4vg-jw5g",
"https://github.com/nextcloud/spreed/pull/542",
"https://hackerone.com/reports/1135481"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*"
],
"vendor_product": "nextcloud:talk",
"extracted_events": [
{
"range": [
{
"fixed": "10.0.7"
},
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-39222",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442141,
"published_at": "2021-11-15T19:15:07.297+00:00"
}