CVE-2022-39333

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

• CWE-79

• https://github.com/nextcloud/desktop/pull/4972Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-92p9-x79h-2mj8Third Party Advisory
• https://hackerone.com/reports/1711847Exploit, Third Party Advisory
• https://github.com/nextcloud/desktop/pull/4972Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-92p9-x79h-2mj8Third Party Advisory
• https://hackerone.com/reports/1711847Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html

Published

Nov 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39328Grafana is an open-source platform for monitoring and observ…8.1
• CVE-2022-39329Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2022-3933The Essential Real Estate WordPress plugin before 3.9.6 does…5.4
• CVE-2022-39330Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-39331Nexcloud desktop is the Desktop sync client for Nextcloud. A…5.4
• CVE-2022-39332Nexcloud desktop is the Desktop sync client for Nextcloud. A…5.4
• CVE-2022-39334Nextcloud also ships a CLI utility called nextcloudcmd which…4.7
• CVE-2022-39335Synapse is an open-source Matrix homeserver written and main…5
• CVE-2022-39337Hertzbeat is an open source, real-time monitoring system wit…7.5
• CVE-2022-39338user_oidc is an OpenID Connect user backend for Nextcloud. V…5.4
• CVE-2022-39339user_oidc is an OpenID Connect user backend for Nextcloud. I…4.3
• CVE-2022-3934The FlatPM WordPress plugin before 3.0.13 does not sanitise …5.4