CVE-2021-47844CWE-79

Xmind 2020 - Persistent Cross-Site Scripting

Medium · published January 16, 2026

CVSS v4.0

5.1

EPSS

Percentile

31.5

In the wild

Unconfirmed

What it is

Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind mapping files or custom headers. Attackers can craft malicious files with embedded JavaScript that execute system commands when opened, enabling remote code execution through mouse interactions or file opening.

The record

Technical detail

CVSS v4.0: 5.1 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS: 0.00386 · 31.5th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-01-16T19:09Z

EPSS history

Timeline

16 JAN 19:09Z
Xmind 2020 - Persistent Cross-Site Scripting
cvelistv5