Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-23445

22
FAUCET Score

CVE-2021-23445 is a medium-severity cross-site scripting (CWE-79) vulnerability affecting the datatables.net package before version 1.11.3. It allows for unescaped HTML entities if an array is passed to the escape function, potentially leading to client-side script execution. The vulnerability has a CVSS score of 6.1, indicating a network-based attack requiring user interaction, with low impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.11.3CPE matchmatch criteria
cpe:2.3:a:datatables:datatables.net:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

3.1LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.6
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.98%
Probability of exploitation in next 30 days
EPSS Percentile
78.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0198 is in the 89th percentile among its peer group of 26,221 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (44)

github_advisorypatch availablevia nvd_reference
View patch
nodejspatch availablevia llm_extracted
Fixed in: 6.4.1
npmpatch availablevia ghsa
Product: datatables.netFixed in: 1.11.3
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-hal-console-0:3.3.22-1.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-infinispan-0:11.0.19-2.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-ejb-client-0:4.0.54-3.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-jsf-api_2.3_spec-0:3.0.0-8.SP08_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-metadata-0:13.5.0-1.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-modules-0:1.12.3-3.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-jboss-server-migration-0:1.10.0-36.Final_redhat_00035.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-undertow-0:2.2.32-1.SP1_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wildfly-0:7.4.17-2.GA_redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wildfly-discovery-0:1.2.4-1.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wildfly-elytron-0:1.15.23-2.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wildfly-http-client-0:1.1.17-1.Final_redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wildfly-transaction-client-0:1.1.19-1.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-wss4j-0:2.4.3-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-xml-security-0:2.3.4-1.redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-hal-console-0:3.3.22-1.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-infinispan-0:11.0.19-2.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-ejb-client-0:4.0.54-3.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-jsf-api_2.3_spec-0:3.0.0-8.SP08_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-metadata-0:13.5.0-1.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-modules-0:1.12.3-3.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-jboss-server-migration-0:1.10.0-36.Final_redhat_00035.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-undertow-0:2.2.32-1.SP1_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-0:7.4.17-2.GA_redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-discovery-0:1.2.4-1.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-elytron-0:1.15.23-2.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-http-client-0:1.1.17-1.Final_redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wildfly-transaction-client-0:1.1.19-1.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-xml-security-0:2.3.4-1.redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-hal-console-0:3.3.22-1.Final_redhat_00001.1.el7eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-wss4j-0:2.4.3-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application PlatformFixed in: org.jboss.hal/hal-console:3.3.22.Final-redhat-00001
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-apache-cxf-0:3.5.8-1.redhat_00001.1.el8eap
View patch
redhatno patchvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: datatables.net
redhatend of lifevia redhat_api
Product: Red Hat Fuse 7Fixed in: datatables.net
redhatend of lifevia redhat_api
Product: Red Hat JBoss Data Grid 7Fixed in: datatables.net
redhatend of lifevia redhat_api
Product: Red Hat Discovery 1Fixed in: discovery-server-container
redhatend of lifevia redhat_api
Product: Red Hat Process Automation 7Fixed in: datatables.net
redhatend of lifevia redhat_api
Product: Red Hat Virtualization 4Fixed in: cockpit-ovirt
redhatend of lifevia redhat_api
Product: Red Hat Decision Manager 7Fixed in: datatables.net

Vendor Advisories (4)

nodejsllm-nodejs-4fb9cb232e5037bfCRITICAL

Third-Party Package Updates in Splunk SOAR - July 2025

Jul 7, 2025
npmGHSA-h73q-5wmj-q8pjmedium

Cross site scripting in datatables.net

Sep 29, 2021
redhatCVE-2021-23445Moderate

datatables.net: contents of array not escaped by HTML escape entities function

Sep 27, 2021
microsoft2021-Sep/CVE-2021-23445Moderate

Cross-site Scripting (XSS)

Sep 14, 2021

References

cdn.datatables.net / 1.11.3
Release NotesVendor Advisory
github.com / DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b
PatchThird Party Advisory
lists.debian.org / debian-lts-announce/2023/08/msg00018.html
security.netapp.com / advisory/ntap-20240621-0006
snyk.io / vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371
ExploitThird Party Advisory
snyk.io / vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376
ExploitThird Party Advisory
snyk.io / vuln/SNYK-JS-DATATABLESNET-1540544
ExploitThird Party Advisory