Security readout for executives and security teams
Plain-English summary
HTMLy 2.8.1 has a stored cross-site scripting issue in the dashboard post editor. An authenticated attacker could save script or HTML in a regular post's content field, causing it to run later when viewed. The source bundle does not provide CVSS scoring or a confirmed patch.
Executive priority
Treat this as a contained but real CMS integrity risk. Prioritize if HTMLy 2.8.1 is internet-facing or has multiple content authors. Urgency is lower where only trusted administrators can post and vendor guidance has already been applied.
Technical view
The reported flaw is stored XSS in HTMLy 2.8.1, reachable through authenticated POST requests to add content from the dashboard regular post workflow. The vulnerable input is the post content field. Available sources do not provide a CWE, CVSS vector, affected-version range, or remediation release.
Likely exposure
Exposure is most likely on HTMLy 2.8.1 sites where untrusted or lower-privileged users can access the dashboard and create regular posts. Public-only visitors are not described as direct attackers in the provided sources.
Exploitation context
The CVE describes authenticated remote POST requests as the attack condition. CISA KEV is false in the source bundle, and no cited source confirms active exploitation. Impact depends on where stored post content is rendered and who views it.
Researcher notes
Evidence is sparse. The CVE text and GitHub issue are the only specific sources in the bundle. The description supports authenticated stored XSS, but not unauthenticated exploitation, active exploitation, affected versions beyond 2.8.1, or a named patched version.
Mitigation direction
- Check HTMLy vendor guidance and issue 481 for a fixed release or official workaround.
- Upgrade HTMLy if an official fixed version is identified by the vendor.
- Restrict dashboard content creation to trusted users only.
- Review existing posts from untrusted authors for unsafe embedded HTML or scripts.
- Ensure rendered content is sanitized or output-encoded according to vendor guidance.
Validation and detection
- Inventory HTMLy deployments and identify any running version 2.8.1.
- Confirm who can authenticate to the dashboard and create regular posts.
- Review content rendering paths for sanitization or output encoding.
- Use a harmless non-executing marker in a test post to verify rendering behavior.
- Check logs for unexpected authenticated content creation around public post changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-36702 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/danpros/htmly/issues/481CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.