CVE-2023-42808

Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that user-controlled data flows to a path expression (path of a network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin. As of time of publication, it is unknown whether any patches or workarounds exist.

• CWE-79

• https://github.com/mozilla/common-voice/blob/9d6ffd755e29b81918b86b9f5218b9c27d9c1c1a/server/src/fetch-legal-document.ts#LL21-L62C2Product
• https://github.com/mozilla/common-voice/blob/9d6ffd755e29b81918b86b9f5218b9c27d9c1c1a/server/src/server.ts#L214Product
• https://securitylab.github.com/advisories/GHSL-2023-026_Common_Voice/Exploit, Third Party Advisory
• https://github.com/mozilla/common-voice/blob/9d6ffd755e29b81918b86b9f5218b9c27d9c1c1a/server/src/fetch-legal-document.ts#LL21-L62C2Product
• https://github.com/mozilla/common-voice/blob/9d6ffd755e29b81918b86b9f5218b9c27d9c1c1a/server/src/server.ts#L214Product
• https://securitylab.github.com/advisories/GHSL-2023-026_Common_Voice/Exploit, Third Party Advisory

Published

Oct 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42802GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-42803BigBlueButton is an open-source virtual classroom. BigBlueBu…8.8
• CVE-2023-42804BigBlueButton is an open-source virtual classroom. BigBlueBu…5.3
• CVE-2023-42805quinn-proto is a state machine for the QUIC transport protoc…7.5
• CVE-2023-42806Hydra is the layer-two scalability solution for Cardano. Pri…6.5
• CVE-2023-42807Frappe LMS is an open source learning management system. In …9.8
• CVE-2023-42809Redisson is a Java Redis client that uses the Netty framewor…8.8
• CVE-2023-4281This Activity Log WordPress plugin before 2.8.8 retrieves cl…5.3
• CVE-2023-42810systeminformation is a System Information Library for Node.J…9.8
• CVE-2023-42811aes-gcm is a pure Rust implementation of the AES-GCM. Starti…5.5
• CVE-2023-42812Galaxy is an open-source platform for FAIR data analysis. Pr…4.3
• CVE-2023-42813Kyverno is a policy engine designed for Kubernetes. A securi…5.3