CVE-2022-27979

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2023-04-26

Last modified

2026-07-09

Weaknesses

CWE-79

Affected products

• Tooljet (Tooljet)

References

• https://github.com/fourcube/security-advisories/blob/main/security-advisories/20220321-tooljet-xss.md