The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection
Published Mar 15, 2019
6.1
MEDIUMCVSS 3.0
EPSS 6.16%
Description
The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot
Affected products
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N/AC:M/Au:N/C:N/I:P/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.
Score over time
2021-2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Table of values (30 key points)
Flat stretches are collapsed. Showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 4, 2026 | 6.16% (0.06156) | 93.27th | v5 (v2026.06.15) |
| Oct 1, 2026 | 6.16% (0.06156) | 93.26th | v5 (v2026.06.15) |
| Sep 22, 2026 | 5.10% (0.05100) | 91.98th | v5 (v2026.06.15) |
| Sep 21, 2026 | 6.46% (0.06455) | 93.51th | v5 (v2026.06.15) |
| Sep 6, 2026 | 5.10% (0.05100) | 91.80th | v5 (v2026.06.15) |
| Sep 5, 2026 | 6.46% (0.06455) | 93.36th | v5 (v2026.06.15) |
| Aug 30, 2026 | 5.10% (0.05100) | 91.76th | v5 (v2026.06.15) |
| Aug 28, 2026 | 6.46% (0.06455) | 93.32th | v5 (v2026.06.15) |
| Aug 24, 2026 | 5.10% (0.05100) | 91.71th | v5 (v2026.06.15) |
| Aug 23, 2026 | 6.46% (0.06455) | 93.29th | v5 (v2026.06.15) |
| Jun 15, 2026 | 5.10% (0.05100) | 91.24th | v5 (v2026.06.15) |
| Jun 14, 2026 | 6.53% (0.06530) | 91.36th | v4 (v2025.03.14) |
| Nov 21, 2025 | 8.27% (0.08272) | 91.88th | v4 (v2025.03.14) |
| Nov 18, 2025 | 6.85% (0.06854) | 90.45th | v4 (v2025.03.14) |
| Jul 30, 2025 | 9.07% (0.09067) | 92.29th | v4 (v2025.03.14) |
| Mar 17, 2025 | 6.72% (0.06716) | 90.56th | v4 (v2025.03.14) |
| Dec 17, 2024 | 3.16% (0.03156) | 90.91th | v3 (v2023.03.01) |
| Dec 12, 2024 | 1.91% (0.01907) | 89.03th | v3 (v2023.03.01) |
| Jun 23, 2024 | 2.37% (0.02370) | 89.91th | v3 (v2023.03.01) |
| Mar 26, 2024 | 1.84% (0.01838) | 88.00th | v3 (v2023.03.01) |
| Mar 8, 2024 | 3.10% (0.03098) | 90.78th | v3 (v2023.03.01) |
| Feb 22, 2024 | 2.11% (0.02107) | 88.82th | v3 (v2023.03.01) |
| Feb 4, 2024 | 1.53% (0.01534) | 85.76th | v3 (v2023.03.01) |
| Jan 19, 2024 | 1.32% (0.01324) | 84.58th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.41% (0.01407) | 84.38th | v3 (v2023.03.01) |
| Mar 6, 2023 | 8.38% (0.08382) | 93.89th | v2 (v2022.01.01) |
| Apr 1, 2022 | 8.38% (0.08382) | 93.35th | v2 (v2022.01.01) |
| Feb 4, 2022 | 15.12% (0.15118) | 91.33th | v2 (v2022.01.01) |
| Feb 3, 2022 | 4.80% (0.04797) | 78.14th | v5 (v2026.06.15) |
| Apr 14, 2021 | 4.80% (0.04797) | 0.00th | v1 |
References (3)
- https://github.com/netdata/netdata/issues/5800#issuecomment-510986112 x_refsource_MISCThird Party Advisory
- https://www.exploit-db.com/exploits/46545 exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
- https://www.youtube.com/watch?v=zSG93yX0B8k x_refsource_MISCExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/netdata/netdata/issues/5800#issuecomment-510986112 | x_refsource_MISCThird Party Advisory | |
| https://www.exploit-db.com/exploits/46545 | exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry | |
| https://www.youtube.com/watch?v=zSG93yX0B8k | x_refsource_MISCExploitThird Party Advisory |
Change history (0)
No recorded changes yet.