CVE-2021-23562: 
JavaScript vulnerability analysis and mitigation

CVE-2021-23562 affects the plupload package versions before 2.3.9. The vulnerability allows a file name containing JavaScript code to be uploaded and executed, requiring an attacker to trick a user into uploading a malicious file (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) by NIST with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, while Snyk rates it at 4.2 (MEDIUM) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

The vulnerability could lead to arbitrary JavaScript code execution if an attacker successfully tricks a user into uploading a maliciously crafted file. This could potentially result in high impacts on confidentiality, integrity, and availability of the affected system (Snyk).

The vulnerability was fixed in plupload version 2.3.9. Users should upgrade to this version or later to mitigate the risk. The fix involves proper encoding of HTML entities in the file handling process (GitHub Commit).