CVE-2021-38138: OneNav beta 0.9.12 allows XSS via the Add Link feature.

Security readout for executives and security teams

CVE-2021-38138 is a cross-site scripting issue in OneNav beta 0.9.12 through the Add Link feature. The vendor stated XSS protection was not present at that time and considered the risk mainly tied to a compromised account. There is no cited evidence of active exploitation. Exposure is most likely limited to organizations running OneNav beta 0.9.12, especially where untrusted or compromised users can access Add Link. The source bundle does not establish broader version impact. Prioritize this if OneNav beta 0.9.12 is deployed or exposed to multiple users. It is not KEV-listed and lacks severity scoring, but XSS can create session and trust risks when accounts are compromised or shared. Mitigation focus: Inventory any OneNav deployments and identify beta 0.9.12 instances.; Review OneNav releases and vendor issue guidance for XSS protection updates.; Restrict OneNav administrative access to trusted accounts and networks..

Prepared

Jun 2, 2026, 19:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.