CVE-2021-39205

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

• CWE-79
• CWE-1321
• CWE-79
• CWE-1321

• https://github.com/jitsi/jitsi-meet/pull/9320Patch, Third Party Advisory
• https://github.com/jitsi/jitsi-meet/pull/9404Patch, Third Party Advisory
• https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fgThird Party Advisory
• https://hackerone.com/reports/1214493Permissions Required
• https://github.com/jitsi/jitsi-meet/pull/9320Patch, Third Party Advisory
• https://github.com/jitsi/jitsi-meet/pull/9404Patch, Third Party Advisory
• https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fgThird Party Advisory
• https://hackerone.com/reports/1214493Permissions Required

Published

Sep 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3920grav-plugin-admin is vulnerable to Improper Neutralization o…5.4
• CVE-2021-39200WordPress is a free and open-source content management syste…5.3
• CVE-2021-39201WordPress is a free and open-source content management syste…5.4
• CVE-2021-39202WordPress is a free and open-source content management syste…5.4
• CVE-2021-39203WordPress is a free and open-source content management syste…6.5
• CVE-2021-39204Pomerium is an open source identity-aware access proxy. Envo…7.5
• CVE-2021-39206Pomerium is an open source identity-aware access proxy. Envo…8.6
• CVE-2021-39207parlai is a framework for training and evaluating AI models …8.8
• CVE-2021-39208SharpCompress is a fully managed C# library to deal with man…4.3
• CVE-2021-39209GLPI is a free Asset and IT management software package. In …8.8
• CVE-2021-3921firefly-iii is vulnerable to Cross-Site Request Forgery (CSR…4.3
• CVE-2021-39210GLPI is a free Asset and IT management software package. In …6.5