VYPR
Moderate severityNVD Advisory· Published Jun 21, 2022· Updated Aug 4, 2024

CVE-2021-41924

CVE-2021-41924

Description

Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
krayin/laravel-crmPackagist
< 1.2.21.2.2

Affected products

2

Patches

Vulnerability mechanics

Root cause

"Use of v-html instead of v-text in a Vue.js datagrid component allows unsanitized user input to be rendered as raw HTML."

Attack vector

An attacker can inject malicious JavaScript into a data field that is later displayed in the datagrid table. Because the application used `v-html` instead of `v-text` to render cell content [patch_id=6635923], the injected script executes in the browser of any user who views the affected table row. This is a classic stored Cross-Site Scripting (XSS) attack [CWE-79]. No authentication bypass is required if the attacker can create or edit records whose data appears in the grid.

Affected code

The vulnerability is in `packages/Webkul/UI/src/Resources/assets/js/components/datagrid/table-body.vue`, where the `v-html` directive was used to render row content. This allowed unsanitized user-controlled data to be injected as raw HTML. The patch also addresses a broken access control issue in `packages/Webkul/Admin/src/Http/Controllers/User/AccountController.php` by blocking role/permission fields from being submitted during account updates.

What the fix does

The patch replaces `v-html` with `v-text` in the datagrid table-body component [patch_id=6635923]. `v-html` interprets the bound string as raw HTML, allowing script injection, while `v-text` escapes the content and renders it as plain text. This change ensures that any user-supplied data displayed in the table is safely encoded and cannot execute JavaScript. The same commit also adds server-side validation in `AccountController.php` to reject role/permission fields during account updates, though that change addresses a separate access-control issue.

Preconditions

  • inputThe attacker must be able to create or modify a record whose content is displayed in the datagrid table.
  • authA victim user must view the affected table page in a browser.

Generated on Jun 20, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.