CVE-2021-38138: Onenav

Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days.

OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release.

Affected products

• Onenav Onenav: version 0.9.12 only

Published 2021-08-05. Last modified 2026-06-17.