Security readout for executives and security teams
Plain-English summary
MooTools includes a CSS selector parser vulnerable to denial of service through expensive regular expression processing. Business risk depends on whether an application lets attacker-controlled text reach MooTools selector construction. The published record says no patches are available, so exposure management should focus on inventory, code review, and replacement or containment.
Executive priority
Treat this as a moderate availability risk for legacy MooTools-dependent applications. Prioritize applications exposed to untrusted user input and business-critical browser or JavaScript workflows, especially because the sources state no patch is available.
Technical view
CVE-2021-32821 is a CWE-400 ReDoS issue in MooTools. Sources state all known versions include the vulnerable CSS selector parser, while the affected record lists mootools-core 1.6.0. Exploitation requires injection of a string into a CSS selector at runtime. CVSS 3.1 is 6.2 with high availability impact.
Likely exposure
Exposure is most likely in legacy web applications that still load MooTools and build CSS selectors from URL, form, DOM, API, or other attacker-influenced data. Systems using MooTools only with fixed, trusted selectors have lower practical exposure.
Exploitation context
The bundle does not show KEV listing or cited active exploitation. The issue requires attacker-controlled selector input, so risk is application-specific. Successful abuse would target availability, such as causing a page or JavaScript environment to hang, rather than stealing data or modifying records.
Researcher notes
Key constraints are important: no KEV signal in the bundle, no active exploitation evidence, and no named patch. The GitHub Security Lab advisory is the primary technical reference. Validate real exploitability through data-flow review, not library presence alone.
Mitigation direction
- Inventory MooTools and mootools-core usage across source, packages, and static assets.
- Remove or replace MooTools where attacker-influenced selector input exists.
- Avoid passing untrusted strings into MooTools CSS selector construction.
- Constrain selector inputs to fixed, trusted values where replacement is not immediate.
- Monitor the MooTools project and vendor guidance, since sources name no patch.
Validation and detection
- Check dependency manifests and bundled JavaScript for MooTools or mootools-core.
- Map every MooTools selector call that uses dynamic input.
- Confirm URL, form, DOM, or API values cannot reach selector parsing untrusted.
- Run non-destructive performance tests for affected selector paths in staging.
- Record compensating controls and remaining MooTools usage in the vulnerability register.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32821 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.