CVE-2022-24833

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.

• CWE-79

• https://github.com/PrivateBin/PrivateBin/commit/2a4d572c1e9eb9b608d32b0cc0cb3b6c3b684eabPatch, Third Party Advisory
• https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-cqcc-mm6x-vmvwExploit, Third Party Advisory
• https://github.com/PrivateBin/PrivateBin/commit/2a4d572c1e9eb9b608d32b0cc0cb3b6c3b684eabPatch, Third Party Advisory
• https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-cqcc-mm6x-vmvwExploit, Third Party Advisory

Published

Apr 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24828Composer is a dependency manager for the PHP programming lan…8.8
• CVE-2022-24829Garden is an automation platform for Kubernetes development …9.8
• CVE-2022-2483 The bootloader in the Nokia ASIK AirScale system module (ve…7.1
• CVE-2022-24830OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24831OpenClinica is an open source software for Electronic Data C…9.8
• CVE-2022-24832GoCD is an open source a continuous delivery server. The bun…6.8
• CVE-2022-24834Redis is an in-memory database that persists on disk. A spec…8.8
• CVE-2022-24836Nokogiri is an open source XML and HTML library for Ruby. No…7.5
• CVE-2022-24837HedgeDoc is an open-source, web-based, self-hosted, collabor…5.3
• CVE-2022-24838Nextcloud Calendar is a calendar application for the nextclo…9.8
• CVE-2022-24839org.cyberneko.html is an html parser written in Java. The fo…7.5
• CVE-2022-2484 The signature check in the Nokia ASIK AirScale system mod…7.8