CVE-2021-27938: Symbiote Silverstripe Queued Jobs

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.

Affected products

• Symbiote Silverstripe Queued Jobs: from 3.0.0, before 3.0.2 (fixed in 3.0.2); from 3.1.0, before 3.1.4 (fixed in 3.1.4); from 4.0.0, before 4.0.7 (fixed in 4.0.7); from 4.1.0, before 4.1.2 (fixed in 4.1.2); from 4.2.0, before 4.2.4 (fixed in 4.2.4); from 4.3.0, before 4.3.3 (fixed in 4.3.3); …

Published 2021-03-16. Last modified 2026-06-17.