CVE-2021-47835
Published: 16 January 2026
Summary
CVE-2021-47835 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Freeter (inferred from references). Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2021-47835 is a persistent cross-site scripting vulnerability (CWE-79) affecting Freeter version 1.2.1. The flaw enables attackers to store malicious payloads in custom widget titles and files within the application.
Remote attackers require no privileges (PR:N) to exploit this issue over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation executes embedded scripts when victims interact with affected custom widgets or files, potentially enabling remote code execution, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
VulnCheck advisories (https://www.vulncheck.com/advisories/freeter-persistent-cross-site-scripting) provide further details on the vulnerability. A proof-of-concept exploit is available at https://www.exploit-db.com/exploits/49833, with supporting images at https://imgur.com/a/iBuKWm4. The vendor site is https://freeter.io/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2882
Vulnerability details
Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads in custom widget titles and files. Attackers can craft malicious files with embedded scripts that execute when victims interact with the application, potentially enabling remote…
more
code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS directly enables arbitrary JavaScript execution (T1059.007) in the Freeter app context and constitutes exploitation of a vulnerable public-facing application component (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of all user-supplied data (widget titles and uploaded files) to reject or neutralize embedded scripts before storage.
Requires output filtering/encoding of rendered widget content so that stored malicious scripts are neutralized before execution in victims' browsers.
Deploys malicious-code detection mechanisms that can identify and block script payloads in files or widget data at rest or on access.