CVE-2021-21259

CVE-2021-21259 describes a cross-site scripting (XSS) vulnerability in HedgeDoc, an open-source collaborative markdown note-taking software, affecting versions prior to 1.7.2. An unauthenticated attacker could inject arbitrary JavaScript into a note, which would execute when viewed in slide mode, potentially leading to information disclosure or unauthorized actions. The vulnerability has a CVSS score of 6.1 (Medium) due to its network-based attack vector and low attack complexity, though user interaction is required. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.