← Database

CVE-2021-43785

HIGH CVSS: 7.6 Published: 2021-11-26 Modified: 2026-06-17

Description

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.

Affected Platforms

Emoji Button Project Emoji Button

Weakness Type

CWE-79, CWE-79

References