CVE-2021-39178CWE-79

XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0

High · published August 30, 2021

CVSS v3.1
7.5
EPSS
1%
Percentile
66.4
In the wild
Unconfirmed
What it is

Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01139 · 66.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-30T23:55Z
EPSS history
Timeline
  • 30 AUG 23:55Z
    XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0
    cvelistv5