CVE-2021-23445: Cross-Site Scripting in datatables.net
Summary
CVE-2021-23445: Cross site scripting in datatables.net. Affects datatables.net versions < 1.11.3. Fixed in 1.11.3. How to fix ↓
Also tracked for
- datatables.js · Debian:11
The same CVE-2021-23445 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
datatables.net is an npm package that provides advanced interactive tables for the web. It allows developers to enhance the functionality and appearance of HTML tables. However, versions before 1.11.3 are vulnerable to a cross-site scripting (XSS) attack. When an array is passed to the HTML escape entities function, its contents are not properly escaped, leading to potential XSS vulnerabilities.
Vulnerability Detail
The vulnerability in datatables.net allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various consequences, such as unauthorized access to sensitive information, session hijacking, or defacement of the affected website. The vulnerability is classified as CWE-79, which is the Common Weakness Enumeration for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How To Fix
Latest published version: 3.1.4 as of 22 Oct 2026
npm install datatables.net@3.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.3
This is the first release that contains the fix.
npm install datatables.net@1.11.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, developers can implement a workaround by manually escaping the contents of arrays before passing them to the HTML escape entities function. Here's an example of how to do this in JavaScript:
const escapedArray = myArray.map(item => {
return item.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''').replace(///g, '/');
});
Conclusion
In conclusion, the datatables.net package before version 1.11.3 is vulnerable to a cross-site scripting (XSS) attack. It is crucial for developers to update the package to the latest version or apply the provided workaround to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for datatables.net →
FAQ
This vulnerability allows an attacker to execute arbitrary scripts on web pages viewed by users, potentially leading to unauthorized access, data theft, or website defacement.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any known vulnerabilities, including this one.
Yes, the vulnerability can be fixed by updating the datatables.net package to version 1.11.3 or later. This version includes the necessary fixes to properly escape array contents.
If updating the package is not immediately feasible, you can manually escape array contents before passing them to the HTML escape entities function. Refer to the 'workaround' section for an example in JavaScript.
The CWE ID for this vulnerability is CWE-79, which stands for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Related vulnerabilities
Recent vulnerabilities recorded for datatables.net.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
