Cross-site Scripting in Nacos

MEDIUM 6.1CVE-2021-44667 · GHSA-4gr7-qw2q-jxh6 · Published 11/03/2022 · updated 17/06/2026

In short

CVE-2021-44667 is a MEDIUM (CVSS 6.1) vulnerability affecting com.alibaba.nacos:nacos-common, nacos (alibaba).
Chance of exploitation in the next 30 days (EPSS): 0.83%, higher than 57.6% of all vulnerabilities.
Fix: update to 2.1.0-BETA, 1.4.5 or later.

Package	Affected versions	Patched versions
com.alibaba.nacos:nacos-common Maven	`≥ 2.0.0-ALPHA.1, < 2.1.0-BETA< 1.4.5`	`2.1.0-BETA1.4.5`
nacos alibaba	`= 2.0.3`	No fix yet

Description

A Cross Site Scripting (XSS) vulnerability exists in Nacos prior to 1.4.5 and 2.1.0-BETA in auth/users via the (1) pageSize and (2) pageNo parameters.

NVD description

A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.

References

nvd.nist.gov/vuln/detail/CVE-2021-44667 · ADVISORY
alibaba/nacos · WEB
alibaba/nacos#7364 · WEB
alibaba/nacos#8980 · WEB
alibaba/nacos commit cd6d7e3 · WEB
alibaba/nacos commit d062fca · WEB
alibaba/nacos · PACKAGE

More vulnerabilities in com.alibaba.nacos:nacos-common

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.alibaba.nacos:nacos-common

Maven

≥ 2.0.0-ALPHA.1, < 2.1.0-BETA< 1.4.5

2.1.0-BETA1.4.5

nacos

alibaba

= 2.0.3

No fix yet

More vulnerabilities in com.alibaba.nacos:nacos-common

See all →