Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Erxes XOS (≤0.22.3) allows malicious code via links

CVE-2021-32853 · published 3 years ago
Summary

The Erxes experience operating system, up through version 0.22.3, can run unwanted code on a user’s browser if they click a crafted link or are sent there from another site. This could let attackers steal information or change what the user sees. Until a fix is released, avoid clicking suspicious links and consider upgrading to a newer version or contacting the vendor for mitigation steps.

What to do
  • Update erxes erxes to version 0.22.3 or later.
Affected software
Ecosystem VendorProductAffected versions
npm enhtuvshin erxes <= 1.0.1
– erxes erxes < 0.22.3
cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:*
Original advisory text
Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must fo...
Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.6 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published20 Feb 2023
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-g9ph-r9hc-34r8 · GHSA
CVE-2021-32853 · NVD
Track software like this
Free during beta