CVE-2022-27979

MediumCVSS 5.4

Published: 26/04/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.

Risk Assessment

An attacker can exploit this vulnerability to steal user sessions, intercept data, or spread malware within the organization.

Recommendation

Immediately update ToolJet to the latest version that includes a fix for the XSS vulnerability. Additionally, implement input filtering and output encoding for user-supplied data.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.