CVE-2021-28079: Jamovi

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered.

Affected products

• Jamovi Jamovi: up to and including 1.6.18

Published 2021-04-26. Last modified 2026-06-17.