CVE-2021-43787

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

• CWE-79
• CWE-1321
• CWE-79
• CWE-1321

• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
• https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4cPatch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Patch, Release Notes, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fcPatch, Third Party Advisory
• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
• https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4cPatch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Patch, Release Notes, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fcPatch, Third Party Advisory

Published

Nov 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43781Invenio-Drafts-Resources is a submission/deposit module for …4.3
• CVE-2021-43782Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-43783@backstage/plugin-scaffolder-backend is the backend for the …8.5
• CVE-2021-43784runc is a CLI tool for spawning and running containers on Li…5
• CVE-2021-43785@joeattardi/emoji-button is a Vanilla JavaScript emoji picke…6.1
• CVE-2021-43786Nodebb is an open source Node.js based forum software. In af…7.5
• CVE-2021-43788Nodebb is an open source Node.js based forum software. Prior…5
• CVE-2021-43789PrestaShop is an Open Source e-commerce web application. Ver…9.8
• CVE-2021-4379The WooCommerce Multi Currency plugin for WordPress is vulne…6.5
• CVE-2021-43790Lucet is a native WebAssembly compiler and runtime. There is…8.1
• CVE-2021-43791Zulip is an open source group chat application that combines…5.3
• CVE-2021-43792Discourse is an open source discussion platform. In affected…4.3