Security readout for executives and security teams
Plain-English summary
CVE-2021-39169 is a high-severity cross-site scripting issue in Misskey before 12.51.0. A malicious actor could abuse the built-in dialog in the web client to show malicious content and potentially compromise a user’s API request token.
Executive priority
Treat this as a prompt upgrade item for any Misskey service. It is not known to be actively exploited from the provided sources, but token compromise can create account and data risk.
Technical view
Misskey versions earlier than 12.51.0 fail to safely handle a malicious string displayed through the web client dialog, causing CWE-79 XSS. CVSS 3.1 is 8.0 with network access, low complexity, low privileges, and user interaction required. The vendor fixed it in 12.51.0.
Likely exposure
Exposure is limited to Misskey deployments running versions earlier than 12.51.0. Risk is higher where untrusted users can interact with authenticated users through the web client.
Exploitation context
The source bundle does not identify active exploitation, and KEV is false. The vulnerability is still serious because successful XSS could expose API request tokens and affect confidentiality, integrity, and availability for impacted users.
Researcher notes
Evidence is from the CVE record and GitHub advisory. The public bundle confirms affected versions, impact, CVSS, CWE-79, fixed version, and no workaround. It does not provide safe validation payloads or exploitation evidence.
Mitigation direction
- Upgrade Misskey to version 12.51.0 or later.
- Prioritize internet-facing Misskey instances below 12.51.0.
- Do not rely on workarounds; the advisory names none aside from upgrading.
- Review vendor guidance before applying nonstandard compensating controls.
- Investigate and rotate exposed API tokens if compromise is suspected.
Validation and detection
- Inventory all Misskey instances and record exact versions.
- Confirm every deployment is running 12.51.0 or later.
- Check source, package, or container metadata for vulnerable versions.
- Verify the vendor fix or fixed release is present.
- Review account and API activity for suspicious token use.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-39169 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H2.15.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-pmmv-jwqh-f5wwCVE reference · x_refsource_CONFIRM
- https://github.com/misskey-dev/misskey/commit/ec203f7f795766f76b55fecc9248168c1cdf6c99CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.