CVE-2021-41924
Description
Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
krayin/laravel-crmPackagist | < 1.2.2 | 1.2.2 |
Affected products
2Patches
Vulnerability mechanics
Root cause
"Use of v-html instead of v-text in a Vue.js datagrid component allows unsanitized user input to be rendered as raw HTML."
Attack vector
An attacker can inject malicious JavaScript into a data field that is later displayed in the datagrid table. Because the application used `v-html` instead of `v-text` to render cell content [patch_id=6635923], the injected script executes in the browser of any user who views the affected table row. This is a classic stored Cross-Site Scripting (XSS) attack [CWE-79]. No authentication bypass is required if the attacker can create or edit records whose data appears in the grid.
Affected code
The vulnerability is in `packages/Webkul/UI/src/Resources/assets/js/components/datagrid/table-body.vue`, where the `v-html` directive was used to render row content. This allowed unsanitized user-controlled data to be injected as raw HTML. The patch also addresses a broken access control issue in `packages/Webkul/Admin/src/Http/Controllers/User/AccountController.php` by blocking role/permission fields from being submitted during account updates.
What the fix does
The patch replaces `v-html` with `v-text` in the datagrid table-body component [patch_id=6635923]. `v-html` interprets the bound string as raw HTML, allowing script injection, while `v-text` escapes the content and renders it as plain text. This change ensures that any user-supplied data displayed in the table is safely encoded and cannot execute JavaScript. The same commit also adds server-side validation in `AccountController.php` to reject role/permission fields during account updates, though that change addresses a separate access-control issue.
Preconditions
- inputThe attacker must be able to create or modify a record whose content is displayed in the datagrid table.
- authA victim user must view the affected table page in a browser.
Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/advisories/GHSA-v829-j9rr-85v9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-41924ghsaADVISORY
- github.com/krayin/laravel-crm/pull/195/commits/882dc2e7e7e9149b96cf1ccacf34900960b92fb7ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.