Medium severity5.4NVD Advisory· Published May 21, 2023· Updated Jun 17, 2026

CVE-2021-46888

Description

An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hledger/hledger3 versions
cpe:2.3:a:hledger:hledger:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:hledger:hledger:*:*:*:*:*:*:*:*range: <1.23
- (no CPE)
- (no CPE)range: <1.23
osv-coords
pkg:hackage/hledger-web
Range: >= 0.24, < 1.23

Patches

Vulnerability mechanics

References

github.com/simonmichael/hledger/issues/1525nvdExploitIssue TrackingVendor Advisory
github.com/simonmichael/hledger/pull/1663nvdExploitIssue TrackingPatchThird Party Advisory
www.youtube.com/watchnvdExploitThird Party Advisory
github.com/simonmichael/hledger/releases/tag/1.23nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000