CVE-2021-29438

The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.

• CWE-79
• CWE-80

• https://github.com/nextcloud/nextcloud-dialogs/security/advisories/GHSA-g3fq-3v3g-mh32Third Party Advisory
• https://www.npmjs.com/package/%40nextcloud/dialogs
• https://github.com/nextcloud/nextcloud-dialogs/security/advisories/GHSA-g3fq-3v3g-mh32Third Party Advisory
• https://www.npmjs.com/package/%40nextcloud/dialogs

Published

Apr 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29432Sydent is a reference matrix identity server. A malicious us…5.7
• CVE-2021-29433Sydent is a reference Matrix identity server. In Sydent vers…4.3
• CVE-2021-29434Wagtail is a Django content management system. In affected v…4.8
• CVE-2021-29435trestle-auth is an authentication plugin for the Trestle adm…6.5
• CVE-2021-29436Anuko Time Tracker is an open source, web-based time trackin…8.1
• CVE-2021-29437ScratchOAuth2 is an Oauth implementation for Scratch. Any Sc…6.8
• CVE-2021-29439The Grav admin plugin prior to version 1.10.11 does not corr…7.2
• CVE-2021-29440Grav is a file based Web-platform. Twig processing of static…7.2
• CVE-2021-29441Nacos is a platform designed for dynamic service discovery a…9.8
• CVE-2021-29442Nacos is a platform designed for dynamic service discovery a…7.5
• CVE-2021-29443jose is an npm library providing a number of cryptographic o…5.9
• CVE-2021-29444jose-browser-runtime is an npm package which provides a numb…5.9