CVE-2021-23439: Johndatserakis File-Upload-With-Preview

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).

Affected products

• Johndatserakis File-Upload-With-Preview: before 4.2.0 (fixed in 4.2.0)

Published 2021-09-05. Last modified 2026-06-17.