CVE-2022-24833 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin

Q: Which versions are affected by CVE-2022-24833?

2 open source packages ship an affected version, including privatebin/privatebin. It affects 1 product.

Q: Is CVE-2022-24833 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24833 exists.

Q: How do I fix CVE-2022-24833?

Upgrade privatebin/privatebin to 1.4.0 or later.

High 8.2 Published 11 Apr 2022 Updated 22 Apr 2025

Attackers can execute arbitrary JavaScript via crafted SVG attachments in PrivateBin pastes if the instance lacks a proper Content Security Policy.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-24833?

CVE-2022-24833 is a high-severity cross-site scripting vulnerability in PrivateBin, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.

Weakness: CWE-79

Which versions are affected by CVE-2022-24833?

2 open source packages ship an affected version, including privatebin/privatebin. It affects 1 product.

Package	Affected	Fixed in
`privatebin/privatebin` Packagist	From `0.21`	`1.4.0`
`privatebin/privatebin` Packagist	From `0.21`	`1.4.0`

Products include Privatebin Privatebin.

How do I fix CVE-2022-24833?

Upgrade privatebin/privatebin to 1.4.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-24833 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24833 exists.

Sources

Also known as GHSA-cqcc-mm6x-vmvw.