CVE-2021-43787

Name: CVE-2021-43787
Creator: NVD / NIST
Published: 2021-11-29T20:15:08.19+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.1/10EPSS 1.27%

Last modified Jun 17, 2026

CVE-2021-43787 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. EPSS estimates a 1.27% chance of exploitation in the next 30 days.

Description

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

Metrics

CVSS 3.1

6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

1.27%

66.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Nodebb	Nodebb	>= 1.15.5, <= 1.18.4

References

https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4cPatch, Third Party Advisory
https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Patch, Release Notes, Third Party Advisory
https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fcPatch, Third Party Advisory
https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f421473824461ff2ed7755e4cPatch, Third Party Advisory
https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Patch, Release Notes, Third Party Advisory
https://github.com/NodeBB/NodeBB/security/advisories/GHSA-wx69-rvg3-x7fcPatch, Third Party Advisory

Timeline

Published: Nov 29, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-43787?

How severe is CVE-2021-43787?

CVE-2021-43787 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 1.27% probability of exploitation in the next 30 days.

How do I fix CVE-2021-43787?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-43787?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST