CVE-2021-3163

What it actually does

This is a stored cross-site scripting issue in an HTML editor/text-field workflow. User-supplied HTML is persisted without sufficiently neutralizing event-handler attributes, specifically an IMG element using an onloadstart handler. When another user views the stored content, the browser may execute attacker-controlled JavaScript in the security context of the affected web application. Successful exploitation can allow session-context actions, reading page-accessible data, modifying displayed content, or pivoting into additional application workflows available to the victim user. The CVSS vector indicates network exploitability, low attack complexity, no attacker authentication required, but victim interaction is required and impact is limited to confidentiality and integrity rather than direct server-side code execution.

Why it matters to the business

An attacker could plant malicious content that runs when users view it, potentially leading to account misuse, unauthorized changes, data exposure visible to the victim, phishing inside a trusted application, or loss of confidence in the affected service. Because the issue is old, has public exploit information available, and fixed package versions are available, remaining exposure is generally a patch-management or legacy-system risk rather than a newly emerging threat. The provided product metadata lists affected iwd packages in Debian and Ubuntu with fixes available in version 1.5-1; organizations should verify package applicability because the vulnerability description references Slab Quill 4.8.0 while the affected-product list references OS packages.

How an attack unfolds

An attacker identifies a text field or HTML editor that stores user-provided content and later renders that content to other users. The attacker submits crafted HTML containing an image element with an onloadstart JavaScript event handler. If the application stores and re-renders the input without sanitizing the attribute, the payload becomes persistent content. A victim then opens a page, record, comment, document, or profile containing the malicious content. The victim’s browser parses the stored HTML and executes the JavaScript under the affected application’s origin. The attacker can then perform actions available to the victim session, alter the page, steal page-accessible tokens or data where browser protections permit, or display convincing phishing prompts within the trusted interface.

How to fix it

Upgrade affected packages/products to fixed versions. The supplied package data indicates iwd on Debian 11, Debian 12, Debian 13, and Ubuntu 20.04 LTS is fixed in version 1.5-1 or later. For deployments of the HTML editor described in the vulnerability, upgrade beyond Slab Quill 4.8.0 if a vendor-maintained fixed release is available, or replace/disable unsafe HTML editing behavior. Enforce server-side output encoding and HTML sanitization using an allowlist-based sanitizer that removes event-handler attributes such as onloadstart, onclick, onerror, and similar JavaScript-capable attributes. Do not rely only on client-side filtering. Add or tighten Content Security Policy to reduce XSS impact, preferably disallowing inline script and restricting script-src to trusted sources. Mark session cookies HttpOnly, Secure, and SameSite where compatible to limit token theft. Review stored user-generated content and cleanse previously persisted malicious markup after patching.

How to confirm the fix worked

Confirm that installed packages meet or exceed the fixed version listed for the relevant distribution, especially version 1.5-1 or later where applicable. For application-level validation, submit harmless test content containing an IMG tag with an onloadstart attribute into the affected editor or field, then reload the rendered view and verify the attribute is removed, encoded, or otherwise inert. Confirm that the rendered DOM does not contain executable event-handler attributes from user input. Review HTTP responses and browser developer tools to ensure user-provided HTML is safely encoded or sanitized. Validate that Content Security Policy blocks inline JavaScript execution where feasible. Run authenticated and unauthenticated web application scans focused on stored XSS in rich-text fields, comments, descriptions, profile fields, and document editors.

Typical attack path

1. Find an exposed form, editor, comment field, profile field, document field, or other stored-content feature that accepts HTML-like input.
2. Submit content containing an IMG element with an onloadstart event-handler payload.
3. Wait for the application to persist the content and render it to other users without sufficient sanitization.
4. Induce or wait for a privileged or targeted user to view the stored content.
5. Execute JavaScript in the victim’s browser within the affected application origin.
6. Use the victim’s session context to read accessible data, modify records, trigger workflow actions, or present phishing content.

How to detect it

Look for evidence of stored XSS payload creation and subsequent victim views. Relevant sources include web access logs, application audit logs, reverse-proxy/WAF logs, rich-text editor submission logs, database or content-export records containing stored user-generated HTML, browser telemetry where available, and endpoint logs for unusual browser child processes or unexpected outbound requests immediately after viewing affected pages. Search for HTML IMG elements with event-handler attributes, especially onloadstart, in POST bodies, request parameters, JSON payloads, and stored content. Correlate suspicious content submissions with later GET requests by other users to the same page, object, document, comment, or profile. Investigate whether payloads attempted to read cookies, localStorage, CSRF tokens, or page content, or made outbound requests to unfamiliar domains. If malicious stored content is confirmed, identify all users who rendered it, review their account activity after exposure, invalidate sessions where appropriate, and remove or sanitize the stored payload.

• onloadstart=
• onloadstart%3D
• <img
• %3Cimg
• <IMG
• %3CIMG
• document.cookie
• localStorage
• sessionStorage
• new Image(
• fetch(
• XMLHttpRequest
• navigator.sendBeacon
• <script
• %3Cscript

What your security team should do

• Prioritize identifying systems that use the affected HTML editor behavior or the listed OS packages and confirm whether they remain below the fixed version.
• Patch or upgrade affected Debian and Ubuntu packages to 1.5-1 or later where the package mapping is applicable.
• Because the vulnerability description and affected-product metadata appear inconsistent, validate applicability against vendor advisories and software bills of materials before closing remediation as not affected.
• Search stored content repositories, application logs, and web access logs for IMG tags and onloadstart event-handler payloads.
• Review historical access to pages containing suspicious stored content to identify users who may have triggered payload execution.
• Harden the application with allowlist HTML sanitization, contextual output encoding, and a restrictive Content Security Policy.
• Treat privileged-user exposure as higher risk; force reauthentication or rotate sessions for users who viewed confirmed malicious content.
• Add regression tests to prevent event-handler attributes from being stored or rendered in rich-text fields.