CVE-2021-3427 | BDVDB-2026-183269 Detail

Deluge-web

Description#

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://dev.deluge-torrent.org/ticket/3459
https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
https://security.gentoo.org/glsa/202210-07

Exploit#

No public exploit known

History#

Version 12022-08-26Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.