CVE-2021-47839

MediumPublic PoC

Published: 16 January 2026

Published

16 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0004 13.1th percentile

Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-47839 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Imgur (inferred from references). Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

Marky 0.0.1, a markdown-related software component, contains a persistent cross-site scripting vulnerability identified as CVE-2021-47839 (CWE-79). This flaw enables attackers to inject malicious scripts into markdown files through specially crafted uploads. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, changed scope, and potential for limited confidentiality and integrity impacts.

Unauthenticated attackers can exploit this vulnerability by uploading markdown files embedded with JavaScript payloads. When a victim opens the file, the injected scripts execute, potentially leading to remote code execution. The attack requires no user privileges and leverages the application's handling of markdown content to persist and trigger the payload.

Advisories and related resources, including those from Vulncheck at https://www.vulncheck.com/advisories/marky-persistent-cross-site-scripting, provide further details on the issue. A proof-of-concept exploit is available at https://www.exploit-db.com/exploits/49831, and the project's GitHub repository at https://github.com/vesparny/marky offers additional context. Practitioners should consult these for mitigation guidance and patch information.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-2874

Vulnerability details

Marky 0.0.1 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upload crafted markdown files with embedded JavaScript payloads that execute when the file is opened, potentially enabling remote code execution.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Persistent XSS in a network-accessible markdown component directly enables exploitation of a public-facing application for initial access and script execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1