Medium severity5.4NVD Advisory· Published May 21, 2023· Updated Jun 17, 2026

CVE-2021-46888

Description

An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

hledger/hledgerdescription
Hledger/hledgerllm-create
Range: <1.23
osv-coords
pkg:hackage/hledger-web
Range: >= 0.24, < 1.23

Patches

Vulnerability mechanics

References

github.com/simonmichael/hledger/issues/1525nvdExploitIssue TrackingVendor Advisory
github.com/simonmichael/hledger/pull/1663nvdExploitIssue TrackingPatchThird Party Advisory
www.youtube.com/watchnvdExploitThird Party Advisory
github.com/simonmichael/hledger/releases/tag/1.23nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000