CVE-2021-32850 - CVE House
Back to Database
Status published Medium CVE-2021-32850

jQuery MiniColors vulnerable to Cross-site Scripting

Vulnerability Description

jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32850

Credits & Attribution

No credits recorded in the NVD database.

References

More from npm

View All →
CVE-2023-31999
All versions of @fastify/oauth2 used a statically generated state parameter...
Unknown 0
CVE-2022-29244
npm packing does not respect root-level ignore files in workspaces
Unknown 0
CVE-2021-39135
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
High 8.2
CVE-2021-39134
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
High 8.2
CVE-2021-37713
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
High 8.2

Affected Vendor

Affected Software

@claviska/jquery-minicolors
Vulnerable Versions:
2.3.6

Timeline

Official Publish: February 20th, 2023
Last Modified: March 10th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact