CVE-2021-43331: Debian Linux

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.

Affected products

• Debian Debian Linux: version 9.0 only
• GNU Mailman: before 2.1.36 (fixed in 2.1.36)

Published 2021-11-12. Last modified 2026-06-17.