@claviska/jquery-minicolors vulnerable to Cross-site Scripting

MEDIUM 6.1CVE-2021-32850 · GHSA-crh5-vv2v-c82q · Published 20/02/2023 · updated 17/06/2026

In short

CVE-2021-32850 is a MEDIUM (CVSS 6.1) vulnerability affecting jquery-minicolors (jquery-minicolors project), @claviska/jquery-minicolors.
Chance of exploitation in the next 30 days (EPSS): 0.80%, higher than 56.9% of all vulnerabilities.
Fix: update to 2.3.6 or later.

Package	Affected versions	Patched versions
jquery-minicolors jquery-minicolors_project	`< 2.3.6`	`2.3.6`
@claviska/jquery-minicolors npm	`< 2.3.6`	`2.3.6`

Description

jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-32850 · ADVISORY
claviska/jquery-minicolors commit ef13482 · WEB
codepen.io/webbiesdk/pen/oNBQNNV · WEB
claviska/jquery-minicolors · PACKAGE
claviska/jquery-minicolors release 2.3.6 · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO · WEB
securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin · ADVISORY
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free