CVE-2021-3427

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.

• CWE-79
• CWE-79

• https://dev.deluge-torrent.org/ticket/3459Exploit, Issue Tracking, Patch, Vendor Advisory
• https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEgExploit, Issue Tracking, Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-07Third Party Advisory
• https://dev.deluge-torrent.org/ticket/3459Exploit, Issue Tracking, Patch, Vendor Advisory
• https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEgExploit, Issue Tracking, Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-07Third Party Advisory

Published

Aug 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3426There's a flaw in Python 3's pydoc. A local or adjacent atta…5.7
• CVE-2021-34260A buffer overflow vulnerability in the USBH_ParseInterfaceDe…6.8
• CVE-2021-34261An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32C…4.6
• CVE-2021-34262A buffer overflow vulnerability in the USBH_ParseEPDesc() fu…6.8
• CVE-2021-34267An in the USBH_MSC_InterfaceInit() function of STMicroelectr…4.6
• CVE-2021-34268An issue in the USBH_ParseDevDesc() function of STMicroelect…4.6
• CVE-2021-34270An integer overflow in the mintToken function of a smart con…7.5
• CVE-2021-34272A security flaw in the 'owned' function of a smart contract …7.5
• CVE-2021-34273A security flaw in the 'owned' function of a smart contract …7.5
• CVE-2021-3428A flaw was found in the Linux kernel. A denial of service pr…5.5
• CVE-2021-34280Polaris Office v9.103.83.44230 is affected by a Uninitialize…7.8
• CVE-2021-3429When instructing cloud-init to set a random password for a n…5.5