CVE-2021-20066

FAUCET Score

CVE-2021-20066 describes an improper local resource loading vulnerability in jsdom_project jsdom, allowing malicious web pages to manipulate local files when script execution is enabled. With a CVSS score of 5.6 (Medium), this vulnerability requires high attack complexity and has low impacts on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:jsdom_project:jsdom:-:::::::*

CVSS Data

CVSS version used by this source: 3.1

5.6MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

Exploitability Score

2.2

Impact Score

3.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.39%

Probability of exploitation in next 30 days

EPSS Percentile

69.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0139 is in the 40th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

npmpatch availablevia ghsa

Product: jsdomFixed in: 16.5.0

esetvendor investigatingvia llm_extracted

hyperledgervendor investigatingvia llm_extracted

mariadbvendor investigatingvia llm_extracted

omronvendor investigatingvia llm_extracted

openrefinevendor investigatingvia llm_extracted

pnpmvendor investigatingvia llm_extracted

twiliovendor investigatingvia llm_extracted

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-thanos-rhel8

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-prometheus-rhel9

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-grafana

redhatend of lifevia redhat_api

Product: OpenShift Service Mesh 2.0Fixed in: servicemesh-prometheus

redhatend of lifevia redhat_api

Product: OpenShift Service Mesh 2.0Fixed in: servicemesh-grafana

Vendor Advisories (9)

npmGHSA-f4c9-cqv8-9v98low

Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom

May 24, 2022

redhatCVE-2021-20066Moderate

jsdom: improper loading of local resources

Feb 16, 2021

twiliollm-twilio-9e44e010315c7171MEDIUM