CVE-2021-39205 - CVE House
Back to Database
Status published Medium CVE-2021-39205

DOM-based XSS/Content Spoofing via Prototype Pollution

Vulnerability Description

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39205

Credits & Attribution

No credits recorded in the NVD database.

References

More from jitsi

View All →
CVE-2025-64754
Jitsi Meet has DOM Redirect on Microsoft OAuth Flow
Low 2.7
CVE-2022-36736
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web...
Medium 6.1
CVE-2021-39215
Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms
High 7.5
CVE-2021-26812
Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through...
Medium 6.1
CVE-2020-25019
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron...
High 7.5

Affected Vendor

Affected Software

jitsi-meet
Vulnerable Versions:
< 2.0.6173

Timeline

Official Publish: September 15th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-79 CWE-1321

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact