CVE-2021-3427: Deluge Web-UI vulnerable to XSS through a crafted torrent file

August 27, 2022 (updated September 16, 2024)

The Deluge Web-UI is vulnerable to cross-site scripting through a crafted torrent file. The the data from torrent files is not properly sanitised as it’s interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user’s browser session.

References

dev.deluge-torrent.org/ticket/3459
github.com/advisories/GHSA-5c8p-qhch-qhx6
github.com/deluge-torrent/deluge
github.com/pypa/advisory-database/tree/main/vulns/deluge/PYSEC-2022-256.yaml
groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
nvd.nist.gov/vuln/detail/CVE-2021-3427
security.gentoo.org/glsa/202210-07

Code Behaviors & Features

Detect and mitigate CVE-2021-3427 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →