CVE-2021-43785: Emoji Button Project Emoji Button

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.

Affected products

• Emoji Button Project Emoji Button: before 4.6.2 (fixed in 4.6.2)

Published 2021-11-26. Last modified 2026-06-17.