CVE-2021-33496: Cross-site scripting in Dutchcoders transfer.sh
Summary
CVE-2021-33496: Cross-site scripting in Dutchcoders transfer.sh in github.com/dutchcoders/transfer.sh. Affects github.com/dutchcoders/transfer.sh versions < 1.2.4. Fixed in 1.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dutchcoders transfer.sh is an open-source file sharing service written in Go. It allows users to upload and share files through a simple command-line interface. The service is widely used for its simplicity and ease of deployment. However, a vulnerability has been discovered in the transfer.sh codebase that allows for cross-site scripting (XSS) attacks.
Vulnerability Detail
The cross-site scripting vulnerability in Dutchcoders transfer.sh allows an attacker to inject malicious code into the web application, which is then executed by the victim's browser. This can lead to various security risks, such as session hijacking, data theft, or the spread of malware. The vulnerability originates from improper input sanitization in the application's code, allowing user-supplied data to be rendered as HTML without proper validation.
How To Fix
Latest published version: v1.6.1 as of 23 Oct 2026
go get github.com/dutchcoders/transfer.sh@v1.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.4
This is the first release that contains the fix.
go get github.com/dutchcoders/transfer.sh@v1.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the transfer.sh service or restrict access to trusted users only. Additionally, implementing a web application firewall (WAF) can help mitigate the risk of XSS attacks by blocking malicious input.
Conclusion
The cross-site scripting vulnerability in Dutchcoders transfer.sh poses a significant risk to users of the file sharing service. It is crucial for developers to update to version 1.2.4 or later to mitigate the vulnerability. Implementing additional security measures, such as a web application firewall, can provide further protection against XSS attacks.
See every vulnerability recorded for github.com/dutchcoders/transfer.sh →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of the victim's browser, potentially leading to session hijacking, data theft, or the spread of malware.
No, versions prior to 1.2.4 are affected. It is recommended to update to version 1.2.4 or later to mitigate the vulnerability.
There is no evidence of active exploits at the moment. However, it is crucial to patch the vulnerability as soon as possible to prevent potential attacks.
Yes, implementing a WAF can help mitigate the risk of XSS attacks by blocking malicious input. However, it is still recommended to update to the latest version of transfer.sh to address the root cause of the vulnerability.
You can find more information about the vulnerability in the official vulnerability report at https://pkg.go.dev/vuln/GO-2022-0924.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/dutchcoders/transfer.sh.
