CVE-2021-40927: Alfred-Spotify-Mini-Player Alfred Spotify Mini Player

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary web script or HTML via the error parameter.

Affected products

• Alfred-Spotify-Mini-Player Alfred Spotify Mini Player: up to and including 0.13.9

Published 2021-10-01. Last modified 2026-06-17.